CVE-2026-74600: mm/page_table_check: skip special zero mappings
In the Linux kernel, the following vulnerability has been resolved:
mm/pagetablecheck: skip special zero mappings
pagetablecheckset() and pagetablecheckclear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but pagetablecheck can still account them as file-backed pages.
An unprivileged process can populate enough zero mappings to overflow filemapcount and hit the existing BUGON(). The PTE path can do this with the shared zero page, and the PMD path can do the same with huge zero mappings.
Skip special zero mappings in the user page-table accounting paths. Keep the PTE-side ptespecial() check, and identify huge zero PMDs from the mapped folio instead of pmdspecial(). That covers architectures where pmdspecial() is a no-op without adding hugezeropfn checks to the generic counter helpers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.46 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
What level of access does an attacker need?
An unprivileged process can trigger the issue. It must populate enough special zero mappings to overflow file_map_count and reach the existing BUG_ON().
Which mapping types can be used to reach the vulnerable accounting path?
The PTE path is affected through shared zero-page PTE mappings, and the PMD path is affected through huge zero mappings. The fix excludes these special zero mappings from user page-table accounting.
Are architecture-specific PMD special-mapping checks sufficient to address this issue?
No. The huge-zero PMD case is identified from the mapped folio rather than pmd_special(), because pmd_special() is a no-op on some architectures.