CVE-2026-74600 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/page_table_check: skip special zero mappings
page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but page_table_check can still account them as file-backed pages.
An unprivileged process can populate enough zero mappings to overflow file_map_count and hit the existing BUG_ON(). The PTE path can do this with the shared zero page, and the PMD path can do the same with huge zero mappings.
Skip special zero mappings in the user page-table accounting paths. Keep the PTE-side pte_special() check, and identify huge zero PMDs from the mapped folio instead of pmd_special(). That covers architectures where pmd_special() is a no-op without adding huge_zero_pfn checks to the generic counter helpers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel contains a vulnerability within its memory management subsystem specifically affecting the page table checking mechanism, which is designed to validate and account for various types of memory mappings. The core issue resides in the functions page_table_check_set() and page_table_check_clear(), which are responsible for tracking mapping statistics based on whether pages are anonymous or file-backed. These functions incorrectly classify shared zero-page Page Table Entries and huge zero Page Middle Directory entries as regular file-backed pages rather than recognizing them as special mappings that should be excluded from standard accounting logic. This misclassification occurs because the code relies heavily on the PageAnon() check without adequately distinguishing between true anonymous memory and these specific types of zero-filled mappings, which are handled differently by the kernel's virtual memory manager to optimize performance and reduce physical page usage through copy-on-write semantics.
This technical flaw allows an unprivileged local user to exploit the accounting discrepancy by populating a sufficient number of zero mappings within their process address space. By repeatedly creating these special mappings, the attacker can artificially inflate the file_map_count statistic associated with the current memory context. Since this counter is used for internal kernel bookkeeping and limits, exceeding its bounds triggers an existing BUG_ON() assertion failure. This results in a local denial of service condition where the affected process or potentially the entire system may crash due to the triggered kernel panic. The vulnerability affects both standard page table entry paths via shared zero pages and larger huge page mappings through Page Middle Directories, providing multiple vectors for triggering the overflow depending on the architecture and memory configuration of the target system.
From a security classification perspective, this issue aligns with CWE-789: Memory Allocation Exceeds Maximum Limit, as it involves an unexpected increase in internal counter values leading to resource exhaustion or state corruption within kernel space. Furthermore, the exploitation technique falls under ATT&CK T1053: Scheduled Task/Job, specifically when considering persistence mechanisms that might leverage such crashes for system instability, though more accurately it represents a local privilege escalation vector via denial of service if the BUG_ON leads to a full system reboot or crash. The attack requires no special privileges beyond standard user access, making it accessible to any unprivileged process on the affected kernel version. This highlights the importance of rigorous validation in memory management subsystems where internal counters are susceptible to manipulation through legitimate but excessive resource consumption patterns.
The resolution involves modifying the page table checking logic to explicitly skip these special zero mappings during accounting operations. For standard page table entries, the fix retains the use of pte_special() checks to identify and exclude shared zero pages from file-backed counting. For huge pages, the implementation identifies huge zero Page Middle Directories by examining the mapped folio structure rather than relying solely on pmd_special(), which may be a no-op on certain architectures. This approach ensures that these specific mappings are correctly excluded from the file_map_count without introducing architecture-specific checks into generic counter helpers, thereby maintaining code portability and correctness across different hardware platforms. System administrators should apply this kernel update to prevent local denial of service attacks stemming from memory accounting anomalies in modern Linux distributions utilizing affected versions of the page table checking infrastructure.