CVE-2026-74600
Received Received - Intake

Linux Kernel Page Table Check Zero Mapping Bypass

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: skip special zero mappings page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but page_table_check can still account them as file-backed pages. An unprivileged process can populate enough zero mappings to overflow file_map_count and hit the existing BUG_ON(). The PTE path can do this with the shared zero page, and the PMD path can do the same with huge zero mappings. Skip special zero mappings in the user page-table accounting paths. Keep the PTE-side pte_special() check, and identify huge zero PMDs from the mapped folio instead of pmd_special(). That covers architectures where pmd_special() is a no-op without adding huge_zero_pfn checks to the generic counter helpers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74600
EUVD
EUVD-2026-64537

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect accounting of special zero mappings in page tables. The page_table_check functions mistakenly treat shared zero-page PTEs and huge zero PMDs as file-backed pages due to their reliance on PageAnon(). An unprivileged process can exploit this by creating enough zero mappings to overflow file_map_count, triggering a BUG_ON() kernel crash. The fix skips these special zero mappings in user page-table accounting paths.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and requires kernel-level inspection. Detection involves checking kernel logs for BUG_ON() triggers or monitoring file_map_count overflows. Use commands like dmesg | grep BUG or cat /proc/vmcore to inspect kernel memory states. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could allow an unprivileged local attacker to crash the system by causing a kernel panic. The impact includes potential denial-of-service (DoS) conditions where the system becomes unresponsive or requires a reboot. If exploited, it may lead to data loss or service disruption depending on the affected system's role.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-74600. Avoid creating excessive zero mappings in user processes. Monitor system logs for unusual memory allocation patterns or kernel errors. Restrict unprivileged users from performing memory-intensive operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart