CVE-2026-64295

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel Page Ext

Publication date: 2026-07-25

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in the hotplug path, it can lead to a NULL pointer dereference during page_ext_lookup at the boundary of the last valid section when iterator count equals __pgcount. The for_each_page_ext() macro calls page_ext_iter_next() as its loop increment. for_each_page_ext() does a "__page_ext = page_ext_iter_next(&__iter)" at the end. This causes page_ext_iter_next() to increment iter->index past __pgcount and call page_ext_lookup(start_pfn + __pgcount). During memory hotplug (online), the PFN at start_pfn + __pgcount may belong to a section that has not yet been initialized, causing page_ext_lookup() to trigger a NULL pointer dereference. [ 14.555124][ T846] Call trace: [ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P) [ 14.555127][ T846] page_ext_lookup+0x30/0x3c [ 14.555129][ T846] __reset_page_owner+0x11c/0x260 [ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0 [ 14.571204][ T846] __free_pages_core+0x78/0xf0 [ 14.571206][ T846] generic_online_page+0x14/0x24 [ 14.597782][ T846] online_pages+0x178/0x30c [ 14.597784][ T846] memory_block_change_state+0x284/0x32c [ 14.597787][ T846] memory_subsys_online+0x4c/0x64 [ 14.597789][ T846] device_online+0x88/0xb0 [ 14.597791][ T846] online_memory_block+0x30/0x40 [ 14.597793][ T846] walk_memory_blocks+0xac/0xe8 [ 14.597794][ T846] add_memory_resource+0x280/0x298 [ 14.656161][ T846] add_memory+0x60/0x98 Move the iteration boundary enforcement inside the iterator functions, so callers cannot inadvertently access beyond the requested range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-12

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64295

EUVD

EUVD-2026-49007

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 6.15 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the page_ext iteration API fails to validate if a Page Frame Number (PFN) belongs to a valid memory section during iteration. When memory is dynamically added via hotplug, it can cause a NULL pointer dereference at the boundary of the last valid memory section, leading to a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and occurs during memory hotplug operations. Detection requires checking kernel logs for NULL pointer dereference errors during memory operations. Monitor logs for traces like the provided call trace involving page_ext_lookup or memory hotplug events.

Impact Analysis

This vulnerability can cause system instability or crashes when memory hotplug operations are performed, potentially leading to denial-of-service conditions. Systems relying on dynamic memory management may experience unexpected failures.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue. Standards like GDPR and HIPAA focus on data protection, access controls, and system integrity, but this CVE relates to a NULL pointer dereference during memory hotplug operations in the Linux kernel. There is no evidence in the provided text that this vulnerability leads to data breaches or unauthorized access.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. Avoid dynamic memory hotplug operations until the kernel is updated. If hotplug is necessary, ensure the system is running a patched kernel version that includes the fix for page_ext iteration boundary enforcement.

Hi! I’m here to help you understand CVE-2026-64295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70