In the Linux kernel, the following vulnerability has been resolved: mm/hwpoison: clear MFCOUNTINCREASED before retrying getanypage() Hulk Robot reported a panic in putpagetestzero() when testing madvise() with MADVSOFTOFFLINE. The BUG() is triggered when retrying getanypage(). This is because we keep MFCOUNTINCREASED flag in second try but the refcnt is not increased. page dumped because: VMBUGONPAGE(pagerefcount(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:737! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: releasepages+0x53f/0x840 Call Trace: freepagesandswapcache+0x64/0x80 tlbflushmmu+0x6f/0x220 unmappagerange+0xe6c/0x12c0 unmapsinglevma+0x90/0x170 unmapvmas+0xc4/0x180 exitmmap+0xde/0x3a0 mmput+0xa3/0x250 doexit+0x564/0x1470 dogroupexit+0x3b/0x100 _dosysexitgroup+0x13/0x20 _x64sysexitgroup+0x16/0x20 dosyscall64+0x34/0x80 entrySYSCALL64afterhwframe+0x44/0xae Modules linked in: ---[ end trace e99579b570fe0649 ]--- RIP: 0010:releasepages+0x53f/0x840