Pinned pages are memory pages that the kernel keeps fixed in physical memory until they are explicitly released. Unlike ordinary pages, they cannot be moved, swapped out, or reclaimed while pinned. This is used for fast I/O paths such as zerocopy networking, DMA, and some storage operations, where devices or kernel code need stable access to user memory.
In security work, pinned pages matter because they extend the lifetime of sensitive memory and add complex cleanup requirements. If a program, driver, or kernel subsystem pins pages but later fails to unpin them correctly, it can cause memory leaks, resource exhaustion, stale references, or accounting bugs. Attackers sometimes look for these mistakes to trigger denial of service or to reach privilege escalation through bad teardown logic. Defenders should review pin/unpin paths carefully, especially in performance features where the failure path is harder to test than the success path.