PT-2026-64516 · Linux · Linux
CVE-2026-64295
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mm: page ext: add count limit to page ext iter next to prevent invalid PFN access
The page ext iteration API does not validate if the PFN still belongs to a
valid section while advancing the iterator. When dynamically adding
memory in the hotplug path, it can lead to a NULL pointer dereference
during page ext lookup at the boundary of the last valid section when
iterator count equals pgcount.
The for each page ext() macro calls page ext iter next() as its loop
increment. for each page ext() does a " page ext =
page ext iter next(& iter)" at the end. This causes page ext iter next()
to increment iter->index past pgcount and call page ext lookup(start pfn
- pgcount). During memory hotplug (online), the PFN at start pfn + pgcount may belong to a section that has not yet been initialized, causing page ext lookup() to trigger a NULL pointer dereference.
[ 14.555124][ T846] Call trace:
[ 14.555125][ T846] lookup page ext+0x6c/0x108 (P)
[ 14.555127][ T846] page ext lookup+0x30/0x3c
[ 14.555129][ T846] reset page owner+0x11c/0x260
[ 14.571201][ T846] free pages ok+0x5e8/0x8e0
[ 14.571204][ T846] free pages core+0x78/0xf0
[ 14.571206][ T846] generic online page+0x14/0x24
[ 14.597782][ T846] online pages+0x178/0x30c
[ 14.597784][ T846] memory block change state+0x284/0x32c
[ 14.597787][ T846] memory subsys online+0x4c/0x64
[ 14.597789][ T846] device online+0x88/0xb0
[ 14.597791][ T846] online memory block+0x30/0x40
[ 14.597793][ T846] walk memory blocks+0xac/0xe8
[ 14.597794][ T846] add memory resource+0x280/0x298
[ 14.656161][ T846] add memory+0x60/0x98
Move the iteration boundary enforcement inside the iterator functions, so
callers cannot inadvertently access beyond the requested range.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux