CVE-2026-68172
Received Received - Intake

arm64 Kernel Memory Corruption in Huge PTE Handling

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: arm64: make huge_ptep_get handled unaligned addresses huge_ptep_get() can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio (examples of callers are pagemap_hugetlb_range, page_mapped_in_vma). The arm64 helper rewalks the pgtables in find_num_contig to answer whether the huge pte we have maps a contpmd or a contpte hugetlb folio, and returns CONT_PMDS or CONT_PTES, so that it can collect a/d bits over the contiguous ptes. We can falsely return CONT_PTES instead of CONT_PMDS if the addr is not aligned. On systems where CONT_PTES != CONT_PMDS (meaning page size is 16K), we could collect excess A/D bit state, meaning extra work for the kernel. Even worse, we may iterate beyond the PTE table and dereference a garbage ptep pointer to access physical memory we don't own. Since the ptep pointer is a linear map address, we may run off the end of the linear map or into a hole, dereference a VA not mapped into the kernel pgtables and cause kernel panic. Fix this by aligning the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer, to correctly answer whether the huge pte is the base of a contpmd block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68172
EUVD
EUVD-2026-55558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the arm64 function huge_ptep_get handling unaligned virtual addresses incorrectly. When a virtual address points to the middle of a huge page table entry (PTE) mapping, the function may falsely identify a contiguous PTE (contpte) instead of a contiguous PMD (contpmd). This can lead to incorrect collection of access and dirty bits or even kernel memory corruption if the function dereferences an invalid pointer beyond the PTE table.

Detection Guidance

This vulnerability is specific to the Linux kernel's arm64 architecture and involves incorrect handling of unaligned addresses in huge_ptep_get(). Detection requires checking the kernel version and examining memory management behavior. No direct commands exist to detect this flaw externally. Kernel logs or system crashes may indicate exploitation attempts. Review kernel source code for huge_ptep_get() usage in hugetlb contexts.

Impact Analysis

This vulnerability could cause kernel instability, including kernel panics or crashes, if exploited. Systems using arm64 with 16K page sizes may experience performance degradation due to incorrect handling of huge pages. In severe cases, it may allow unauthorized access to kernel memory or cause denial-of-service conditions.

Mitigation Strategies

Apply the kernel patch that aligns the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer. Update to a fixed kernel version. Monitor for kernel panics or memory corruption issues. Disable hugetlb features if unpatched and under active exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart