CVE-2026-74524: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
In the Linux kernel, the following vulnerability has been resolved:
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
removepudmapping() and removep4dmapping() obtain a child table base with pudoffset(p4dp, 0) and p4doffset(pgd, 0), then add the index for addr.
RISC-V folds page-table levels at runtime. When a level is folded, its offset helper returns the parent entry itself, but the index can still be nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39 folds both P4D and PUD, so memory hot-remove can descend into unrelated memory and pass an invalid page to freepages(). This can trigger:
kernel BUG at include/linux/mm.h:1810! VMBUGONPAGE(pagerefcount(page) == 0) archremovememory+0x1e/0x5c tryremovememory+0x15e/0x200 removememory+0x24/0x3c
Only add the index when the corresponding page-table level is enabled, matching p4doffset() and pudoffset().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the issue by ensuring the kernel does not perform page-table walks that assume folded RISC-V page-table levels during memory hot-remove operations; specifically, only add the page-table index when the corresponding page-table level is enabled (RISC-V folds levels at runtime).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74524?
The severity of CVE-2026-74524 is rated at risk 34.
How do I fix CVE-2026-74524?
To fix CVE-2026-74524, ensure you apply the latest updates or patches provided for the Linux kernel that includes the resolution for this vulnerability.
What systems are affected by CVE-2026-74524?
CVE-2026-74524 affects the RISC-V architecture within the Linux kernel.
What type of vulnerability is CVE-2026-74524?
CVE-2026-74524 is an out-of-bounds vulnerability that occurs during memory hot-remove operations in the Linux kernel.
What does CVE-2026-74524 impact in the Linux kernel?
CVE-2026-74524 impacts the page-table walk functionality during memory hot-remove, potentially leading to instability or crashes.