PT-2026-64516 · Linux · Linux
CVE-2026-64295
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
mm: page ext: add count limit to page ext iter next to prevent invalid PFN access
The page ext iteration API does not validate if the PFN still belongs to a
valid section while advancing the iterator. When dynamically adding
memory in the hotplug path, it can lead to a NULL pointer dereference
during page ext lookup at the boundary of the last valid section when
iterator count equals pgcount.
The for each page ext() macro calls page ext iter next() as its loop
increment. for each page ext() does a " page ext =
page ext iter next(& iter)" at the end. This causes page ext iter next()
to increment iter->index past pgcount and call page ext lookup(start pfn
- pgcount). During memory hotplug (online), the PFN at start pfn + pgcount may belong to a section that has not yet been initialized, causing page ext lookup() to trigger a NULL pointer dereference.
[ 14.555124][ T846] Call trace:
[ 14.555125][ T846] lookup page ext+0x6c/0x108 (P)
[ 14.555127][ T846] page ext lookup+0x30/0x3c
[ 14.555129][ T846] reset page owner+0x11c/0x260
[ 14.571201][ T846] free pages ok+0x5e8/0x8e0
[ 14.571204][ T846] free pages core+0x78/0xf0
[ 14.571206][ T846] generic online page+0x14/0x24
[ 14.597782][ T846] online pages+0x178/0x30c
[ 14.597784][ T846] memory block change state+0x284/0x32c
[ 14.597787][ T846] memory subsys online+0x4c/0x64
[ 14.597789][ T846] device online+0x88/0xb0
[ 14.597791][ T846] online memory block+0x30/0x40
[ 14.597793][ T846] walk memory blocks+0xac/0xe8
[ 14.597794][ T846] add memory resource+0x280/0x298
[ 14.656161][ T846] add memory+0x60/0x98
Move the iteration boundary enforcement inside the iterator functions, so
callers cannot inadvertently access beyond the requested range.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux