PT-2026-54810 · Linux · Linux
Published
2026-07-01
·
Updated
2026-07-01
·
CVE-2026-53342
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: call pagetable dtor when freeing hot-removed page tables
Since 5e8eb9aeeda3 ("arm64: mm: always call PTE/PMD ctor in
create pgd mapping()") page-table allocation on ARM64 always calls
pagetable {pte,pmd,pud,p4d} ctor(). This sets the page type to
PGTY table, increments NR PAGETABLE and possible allocates a PTL. However
the matching pagetable dtor() calls were never added.
With DEBUG VM enabled on kernel versions prior to v6.17 without
2dfcd1608f3a9 ("mm/page alloc: let page freeing clear any set page type")
this leads to the following warning when freeing these pages due to
page->page type sharing page-> mapcount:
BUG: Bad page state in process ... pfn:284fbb
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb
flags: 0x17fffc000000000(node=0|zone=2|lastcpupid=0x1ffff)
page type: f2(table)
page dumped because: nonzero mapcount
Call trace:
bad page+0x13c/0x160
free frozen pages+0x6cc/0x860
free pages+0xf4/0x180
free pages+0x54/0x80
free hotplug page range.part.0+0x58/0x90
free empty tables+0x438/0x500
remove pgd mapping.constprop.0+0x60/0xa8
arch remove memory+0x48/0x80
try remove memory+0x158/0x1d8
offline and remove memory+0x138/0x180
It can also lead to leaking the ptl allocation if ALLOC SPLIT PTLOCKS is
defined and incorrect NR PAGETABLE stats. Fix this by calling
pagetable dtor() in free hotplug pgtable page() prior to freeing the page
to undo the effects of calling pagetable * ctor().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux