UBUNTU-CVE-2026-74524: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping() and removep4dmapping() obtain a child table base with pudoffset(p4dp, 0) and p4doffset(pgd, 0), then add the index for addr. RISC-V folds page-table levels at runtime. When a level is folded, its offset helper returns the parent entry itself, but the index can still be nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39 folds both P4D and PUD, so memory hot-remove can descend into unrelated memory and pass an invalid page to freepages(). This can trigger: kernel BUG at include/linux/mm.h:1810! VMBUGONPAGE(pagerefcount(page) == 0) archremovememory+0x1e/0x5c tryremovememory+0x15e/0x200 removememory+0x24/0x3c Only add the index when the corresponding page-table level is enabled, matching p4doffset() and pudoffset().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects RISC-V Linux systems that perform memory hot-remove. Sv48 systems are affected when P4D is folded, and Sv39 systems are affected when both P4D and PUD are folded.
What operation triggers the faulty page-table walk?
The problem occurs during memory hot-remove, when remove_pud_mapping() or remove_p4d_mapping() calculates a child table address for a folded page-table level. A nonzero index can cause the walk to move beyond the parent table into unrelated memory.
How might an affected system present the problem?
Memory removal can descend into unrelated memory and provide an invalid page to __free_pages(). The described result is a kernel BUG involving VM_BUG_ON_PAGE(page_ref_count(page) == 0) during arch_remove_memory, try_remove_memory, or remove_memory.