CVE-2026-64295 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in the hotplug path, it can lead to a NULL pointer dereference during page_ext_lookup at the boundary of the last valid section when iterator count equals __pgcount.
The for_each_page_ext() macro calls page_ext_iter_next() as its loop increment. for_each_page_ext() does a "__page_ext = page_ext_iter_next(&__iter)" at the end. This causes page_ext_iter_next() to increment iter->index past __pgcount and call page_ext_lookup(start_pfn + __pgcount). During memory hotplug (online), the PFN at start_pfn + __pgcount may belong to a section that has not yet been initialized, causing page_ext_lookup() to trigger a NULL pointer dereference.
[ 14.555124][ T846] Call trace:
[ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P)
[ 14.555127][ T846] page_ext_lookup+0x30/0x3c
[ 14.555129][ T846] __reset_page_owner+0x11c/0x260
[ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0
[ 14.571204][ T846] __free_pages_core+0x78/0xf0
[ 14.571206][ T846] generic_online_page+0x14/0x24
[ 14.597782][ T846] online_pages+0x178/0x30c
[ 14.597784][ T846] memory_block_change_state+0x284/0x32c
[ 14.597787][ T846] memory_subsys_online+0x4c/0x64
[ 14.597789][ T846] device_online+0x88/0xb0
[ 14.597791][ T846] online_memory_block+0x30/0x40
[ 14.597793][ T846] walk_memory_blocks+0xac/0xe8
[ 14.597794][ T846] add_memory_resource+0x280/0x298
[ 14.656161][ T846] add_memory+0x60/0x98
Move the iteration boundary enforcement inside the iterator functions, so callers cannot inadvertently access beyond the requested range.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability described in this linux kernel issue represents a critical memory safety flaw within the page extension iteration mechanism that can lead to system crashes and potential privilege escalation. This weakness specifically affects the memory hotplug functionality where dynamically added memory regions can cause invalid memory accesses during page extension lookups. The core problem manifests when iterating through page extension structures using the for_each_page_ext() macro, which internally calls page_ext_iter_next() to advance through memory sections. During memory hotplug operations, particularly when online pages, the iterator fails to validate whether the current page frame number (PFN) still belongs to a valid memory section, creating a window where iteration can proceed beyond legitimate boundaries.
The technical implementation flaw stems from inadequate boundary checking within the page_ext_iter_next() function which increments the iterator index without verifying that the target PFN remains within valid memory section limits. When the iteration count reaches the maximum page count (__pgcount), subsequent calls to page_ext_lookup() attempt to access memory locations that may not yet be initialized or properly mapped, resulting in NULL pointer dereference conditions. This failure occurs particularly during online memory operations where new memory sections are being added and initialized, creating a race condition between the iterator advancement and system memory state updates. The call trace demonstrates this vulnerability cascades through multiple kernel subsystems including page extension lookup mechanisms, page owner reset functions, and memory online operations, ultimately manifesting as a system crash when attempting to access uninitialized memory regions.
The operational impact of this vulnerability extends beyond simple system stability concerns to potentially enable privilege escalation attacks within kernel space. When exploited, the NULL pointer dereference can cause immediate system crashes or more insidiously allow attackers to manipulate kernel memory structures through carefully crafted memory hotplug operations. The vulnerability particularly affects systems utilizing dynamic memory management features where memory sections are frequently added or removed from the running system. This flaw violates fundamental security principles by allowing unbounded memory access patterns that should be strictly bounded by valid memory section limits, making it a prime target for denial of service attacks against critical infrastructure systems.
Mitigation strategies must focus on enforcing strict iteration boundary validation within kernel memory management subsystems to prevent unauthorized access beyond legitimate memory ranges. The fix involves moving the iteration boundary enforcement directly into the iterator functions themselves rather than relying on caller-side validation, ensuring that all iteration operations remain bounded by valid page count limits. This approach aligns with common security practices outlined in the CWE (Common Weakness Enumeration) catalog under weakness categories related to improper input validation and buffer overflows, specifically addressing CWE-129 which covers insufficient bound checking of array data. The solution also corresponds to ATT&CK framework techniques for privilege escalation through kernel exploitation, where the vulnerability represents a path to escalate privileges by manipulating kernel memory management operations. Additionally, this fix addresses security standards related to safe memory access patterns and proper resource boundary validation as recommended in various kernel security hardening guidelines and secure coding practices.