CVE-2026-68172: arm64: make huge_ptep_get handled unaligned addresses
In the Linux kernel, the following vulnerability has been resolved:
arm64: make hugeptepget handled unaligned addresses
hugeptepget() can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio (examples of callers are pagemaphugetlbrange, pagemappedinvma).
The arm64 helper rewalks the pgtables in findnumcontig to answer whether the huge pte we have maps a contpmd or a contpte hugetlb folio, and returns CONTPMDS or CONTPTES, so that it can collect a/d bits over the contiguous ptes. We can falsely return CONTPTES instead of CONTPMDS if the addr is not aligned. On systems where CONTPTES != CONTPMDS (meaning page size is 16K), we could collect excess A/D bit state, meaning extra work for the kernel. Even worse, we may iterate beyond the PTE table and dereference a garbage ptep pointer to access physical memory we don't own. Since the ptep pointer is a linear map address, we may run off the end of the linear map or into a hole, dereference a VA not mapped into the kernel pgtables and cause kernel panic.
Fix this by aligning the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer, to correctly answer whether the huge pte is the base of a contpmd block.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68172?
CVE-2026-68172 has a risk rating of 52 indicating a moderate level of severity.
How do I fix CVE-2026-68172?
To fix CVE-2026-68172, it is recommended to update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-68172?
CVE-2026-68172 affects systems running certain versions of the Linux kernel that utilize hugetlb folios.
What does CVE-2026-68172 involve?
CVE-2026-68172 involves improper handling of unaligned addresses in the huge_ptep_get() function in the Linux kernel.
When was CVE-2026-68172 published?
CVE-2026-68172 was published on August 10, 2026.