Memory corruption via poisoned page cache eviction

Memory corruption in Linux hugetlbfs allows local users to replace a poisoned huge page by mapping or reading its cached file offset. The memory-failure path removes poisoned HugeTLB pages from the page cache, so later access allocates a fresh page instead of preserving the poison state. Exploitation requires local low-privileged access to the affected huge-page file after memory poisoning; the documented impact is availability disruption, not data disclosure or privilege gain.