In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smapshugetlbrange and migration smapshugetlbrange() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUGON in pfnswapentrytopage(). The race is as follows. smapshugetlbrange migratepages hugeptepget removemigrationptes foliounlock pfnswapentryfolio BUGON To fix it, hold ptl lock in smapshugetlb_range().