CVE-2026-53342: Linux Kernel Privilege Escalation Flaw

CVE-2026-53342 Overview

CVE-2026-53342 is a Linux kernel vulnerability affecting the ARM64 memory management subsystem. The flaw resides in the page-table teardown path used during memory hot-remove operations. After commit 5e8eb9aeeda3 ("arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()"), ARM64 page-table allocations invoke pagetable_{pte,pmd,pud,p4d}_ctor(), but the matching pagetable_dtor() calls were never added to free_hotplug_pgtable_page(). The result is corrupted page state, incorrect NR_PAGETABLE accounting, and potential leakage of split page table locks (PTL) when ALLOC_SPLIT_PTLOCKS is enabled.

Critical Impact
Freeing hot-removed page tables without invoking the destructor triggers Bad page state warnings, leaks split PTL allocations, and corrupts kernel memory accounting on ARM64 systems using memory hotplug.

Affected Products

Linux kernel on ARM64 (arm64) architecture
Kernel builds using memory hotplug and arch_remove_memory() code paths
Kernel versions prior to v6.17 without commit 2dfcd1608f3a9, particularly those with DEBUG_VM enabled

Discovery Timeline

2026-07-01 - CVE-2026-53342 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-53342

Vulnerability Analysis

The defect is a constructor/destructor pairing bug in the ARM64 memory management code. When the kernel builds page-table hierarchies through __create_pgd_mapping(), it calls pagetable_pte_ctor(), pagetable_pmd_ctor(), pagetable_pud_ctor(), or pagetable_p4d_ctor() depending on the level. Each constructor sets page->page_type to PGTY_table, increments the NR_PAGETABLE counter, and may allocate a split page table lock.

When memory is hot-removed via offline_and_remove_memory() → arch_remove_memory() → __remove_pgd_mapping() → free_empty_tables(), the page-table pages travel through free_hotplug_pgtable_page() and are released directly with free_pages(). No destructor runs, so page_type remains PGTY_table and any allocated PTL is orphaned.

Root Cause

The root cause is an omitted cleanup call in free_hotplug_pgtable_page(). Because page->page_type shares storage with page->_mapcount, the leftover PGTY_table marker is interpreted by the page allocator's sanity checks as a nonzero mapcount. On kernels with DEBUG_VM enabled, __free_frozen_pages() invokes bad_page() and emits the Bad page state in process warning shown in the commit log. Beyond noise, the missing destructor prevents NR_PAGETABLE from being decremented and, when split PTLs are compiled in, leaks the associated lock structure.

Attack Vector

This is a kernel correctness and memory accounting defect rather than a directly weaponizable remote flaw. Triggering the condition requires the ability to initiate memory hot-remove operations on an ARM64 system, an action typically restricted to privileged administrators or platform firmware. The impact is limited to kernel state corruption, PTL memory leakage, and log noise from the bad page detector. See the kernel fix commit for the exact code path.

Detection Methods for CVE-2026-53342

Indicators of Compromise

Kernel log entries containing BUG: Bad page state in process accompanied by page_type: f2(table) and nonzero mapcount
Call traces including free_hotplug_page_range, free_empty_tables, __remove_pgd_mapping, and arch_remove_memory
Unexplained growth in NR_PAGETABLE counters after repeated memory hot-remove cycles on ARM64 hosts

Detection Strategies

Audit running ARM64 kernels for the presence of the fix using uname -r and cross-reference against the stable commits 95f27fcda681, aaa688ac9f18, and c594b83457cc.
Enable CONFIG_DEBUG_VM in test environments to surface the Bad page state warning during memory hotplug validation.
Correlate dmesg output with hot-remove events sourced from udev or orchestration platforms performing DIMM offlining.

Monitoring Recommendations

Ship kernel ring buffer logs to a centralized SIEM and alert on Bad page state strings originating from ARM64 hosts.
Track /proc/meminfoPageTables and /proc/vmstatnr_page_table_pages trends on systems that regularly perform memory hotplug.
Include ARM64 hot-remove workflows in kernel regression test suites to catch reintroduction of the defect.

How to Mitigate CVE-2026-53342

Immediate Actions Required

Update ARM64 systems to a kernel that includes the fix commits 95f27fcda681, aaa688ac9f18, or c594b83457cc from the stable tree.
Defer non-essential memory hot-remove operations on ARM64 hosts until the patched kernel is deployed.
Restrict access to /sys/devices/system/memory/*/state and related interfaces so only privileged automation can trigger offlining.

Patch Information

The fix adds a pagetable_dtor() invocation in free_hotplug_pgtable_page() prior to freeing the page, reversing the state established by the corresponding constructor. Reference implementations are available in the upstream stable commits: 95f27fcda681, aaa688ac9f18, and c594b83457cc. Distribution vendors should backport these commits into any ARM64 kernel branch derived from mainline after 5e8eb9aeeda3 and before v6.17 plus commit 2dfcd1608f3a9.

Workarounds

Disable CONFIG_DEBUG_VM in production kernels to suppress the bad_page() warning, understanding this hides the symptom without addressing the underlying PTL leak or accounting drift.
Avoid runtime memory hot-remove on affected ARM64 kernels; reboot the host to reclaim removed capacity instead.
Rebuild the kernel without ALLOC_SPLIT_PTLOCKS to eliminate the PTL leak path, accepting the associated locking-contention tradeoff.

bash

# Verify the running ARM64 kernel version and check for the fix
uname -srm
grep -E 'CONFIG_DEBUG_VM|CONFIG_MEMORY_HOTREMOVE|CONFIG_SPLIT_PTLOCK' /boot/config-$(uname -r)

# Monitor page-table accounting across hot-remove cycles
watch -n 5 'grep -E "PageTables|nr_page_table" /proc/meminfo /proc/vmstat'