CVE-2026-64302 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix freeing of PMD-sized vmemmap pages
Commit bf9e4e30f353 ("x86/mm: use pagetable_free()"), switched from freeing non-boot page tables through __free_pages() to pagetable_free().
However, the function is also called to free vmemmap pages.
Given that vmemmap pages are not page tables, already the page_ptdesc(page) is wrong. But worse, pagetable_free() calls:
__free_pages(page, compound_order(page));
Since vmemmap pages are not compound pages (see vmemmap_alloc_block()) -- except for HVO, which doesn't apply here -- only first page of a PMD-sized vmemmap page is freed, leaking the other ones.
Fix it by properly decoupling pagetable and vmemmap freeing. free_pagetable() no longer has to mess with SECTION_INFO, as only the vmemmap is marked like that in register_page_bootmem_memmap().
The indentation in remove_pmd_table() is messed up. Fix that while touching it.
Bootmem info handling will soon be fixed up. For now, handle it similar to free_pagetable(), just avoiding the ifdef.
[ dhansen: changelog munging. More imperative voice ]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability affects the linux kernel's memory management subsystem on x86 architectures where improper handling of virtual memory map pages leads to memory leaks and potential system instability. The issue stems from a flawed implementation in the page table freeing mechanism that incorrectly processes vmemmap pages through the pagetable_free() function, which is designed specifically for page table structures rather than memory map pages.
The technical flaw manifests when the kernel attempts to free PMD-sized vmemmap pages using the pagetable_free() function that was originally intended for boot-time page table cleanup. This function incorrectly assumes all pages are part of page table structures and calls __free_pages(page, compound_order(page)) which only frees the first page of a PMD-sized vmemmap allocation while leaving remaining pages in memory. The fundamental problem lies in the page_ptdesc(page) check which returns incorrect results for vmemmap pages since they are not actual page tables but rather memory map structures used for kernel memory management.
According to CWE-457, this represents a use of uninitialized memory where the system incorrectly handles memory allocation types during deallocation operations. The vulnerability operates at the kernel level with high privilege implications and can be exploited through memory allocation patterns that trigger the faulty code path in the x86 memory management subsystem. The ATT&CK framework would categorize this under T1059.001 for system commands and potentially T1070.004 for file and directory permissions modification, as improper memory handling can affect kernel memory layout.
The operational impact includes memory leaks that gradually consume available system resources over time, potentially leading to system performance degradation or out-of-memory conditions. The memory leak occurs because only portions of PMD-sized vmemmap allocations are freed, with the remaining pages becoming unreclaimable and effectively lost to the system. This issue particularly affects systems with large memory configurations where vmemmap pages are frequently allocated and deallocated during kernel operation.
The fix implements proper decoupling between page table freeing and vmemmap freeing operations by ensuring that vmemmap pages are handled through appropriate memory management functions rather than being processed through the pagetable_free() pathway. The solution removes the incorrect handling of SECTION_INFO markers that were previously applied to vmemmap pages in register_page_bootmem_memmap(), since only actual vmemmap structures require this marking while page tables do not. Additionally, the fix addresses indentation issues in remove_pmd_table() and maintains consistency with the current bootmem information handling approach, avoiding the need for conditional compilation directives that complicate maintenance.
The patch resolves memory management inconsistencies by ensuring that different types of kernel memory allocations receive appropriate deallocation treatment based on their actual structure and purpose. This follows secure coding practices outlined in industry standards where memory management functions must correctly identify and handle different types of kernel objects to prevent resource leaks and maintain system stability. The fix specifically addresses the improper assumption that all pages processed through pagetable_free() are legitimate page table structures, which is not true for vmemmap pages that require specialized handling due to their unique role in kernel virtual memory management.