CVE-2026-64295: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64295 Overview

CVE-2026-64295 is a NULL pointer dereference vulnerability in the Linux kernel's memory management subsystem. The flaw resides in the page_ext iteration API, specifically in the page_ext_iter_next() function. The iterator fails to validate whether a Page Frame Number (PFN) still belongs to a valid memory section while advancing. During memory hotplug operations, the iterator can reference uninitialized sections, triggering a NULL pointer dereference in page_ext_lookup().

Critical Impact
The vulnerability causes a kernel crash during memory hotplug operations, resulting in denial of service on affected Linux systems that dynamically add memory at runtime.

Affected Products

Linux kernel versions containing the page_ext iteration API with for_each_page_ext() macro
Systems configured with memory hotplug support (CONFIG_MEMORY_HOTPLUG)
Kernels with page owner tracking or other page_ext-dependent features enabled

Discovery Timeline

2026-07-25 - CVE-2026-64295 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64295

Vulnerability Analysis

The vulnerability originates in the page_ext iteration API used for traversing page extension metadata. The for_each_page_ext() macro invokes page_ext_iter_next() as its loop increment, executing __page_ext = page_ext_iter_next(&__iter) at the end of each iteration. This causes page_ext_iter_next() to increment iter->index past __pgcount and call page_ext_lookup(start_pfn + __pgcount).

During memory hotplug operations, the PFN at start_pfn + __pgcount may reference a section that has not yet been initialized. When page_ext_lookup() attempts to resolve this PFN, it dereferences a NULL pointer, crashing the kernel. The observed call trace shows the fault propagating through lookup_page_ext, __reset_page_owner, __free_pages_ok, generic_online_page, and ultimately add_memory_resource during the memory online path.

Root Cause

The root cause is missing boundary enforcement inside the iterator functions themselves. The iteration API assumed callers would respect the requested range, but the loop increment executes one step beyond the valid boundary before the loop condition halts iteration. This one-past-the-end access reaches into memory sections that may not yet exist during hotplug initialization [CWE-476].

Attack Vector

The vulnerability manifests during memory hotplug operations invoked through add_memory() and online_pages(). Triggering the condition requires the ability to add memory dynamically to a running system. The vulnerability primarily represents a stability and denial-of-service concern rather than a direct code execution vector. See the kernel commit for the fix for the exact code path.

No public exploit code exists for this vulnerability. The issue was resolved by moving iteration boundary enforcement inside the iterator functions, preventing callers from inadvertently accessing PFNs beyond the requested range.

Detection Methods for CVE-2026-64295

Indicators of Compromise

Kernel panic or oops messages referencing lookup_page_ext+0x6c/0x108 and page_ext_lookup+0x30/0x3c in call traces
Unexpected system crashes correlated with memory hotplug events such as add_memory_resource, online_pages, or memory_block_change_state
NULL pointer dereference reports in dmesg originating from the __reset_page_owner code path

Detection Strategies

Monitor kernel logs for NULL pointer dereference stack traces containing page_ext_lookup alongside memory hotplug functions
Audit deployed kernel versions against the fixed commits 377b1cd6bbcf, 8dcaa0f87a88, and ffd017237cfe from the stable tree
Track memory hotplug activity in cloud and virtualized environments where dynamic memory sizing is common

Monitoring Recommendations

Ingest kernel telemetry and dmesg output into a centralized log platform to identify recurring crash signatures
Alert on unplanned reboots on systems that support memory hotplug, particularly virtual machines and containers on hosts using memory ballooning
Correlate crash events with memory management operations to distinguish this issue from unrelated kernel faults

How to Mitigate CVE-2026-64295

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 377b1cd6bbcf, 8dcaa0f87a88, and ffd017237cfe
Update to a stable Linux kernel release that includes the fix from your distribution vendor
Prioritize patching on hosts that perform frequent memory hotplug operations, including virtualization hosts and cloud instances

Patch Information

The fix moves iteration boundary enforcement inside the iterator functions so callers cannot access PFNs beyond the requested range. Patches are available in the stable kernel tree at the primary fix commit, the backport commit, and the additional backport commit.

Workarounds

Disable memory hotplug on systems where dynamic memory addition is not required by not enabling CONFIG_MEMORY_HOTPLUG or by disabling hotplug in the bootloader
Disable page_owner tracking (page_owner=off kernel parameter) to reduce use of the affected iterator path
Avoid triggering online_pages operations on unpatched kernels until updates can be applied

bash

# Verify kernel version and check for the fix
uname -r

# Check whether memory hotplug is enabled
grep CONFIG_MEMORY_HOTPLUG /boot/config-$(uname -r)

# Disable page_owner at boot by editing /etc/default/grub
# GRUB_CMDLINE_LINUX_DEFAULT="... page_owner=off"
sudo update-grub

# Apply distribution kernel update
sudo apt update && sudo apt upgrade linux-image-generic   # Debian/Ubuntu
sudo dnf update kernel                                    # RHEL/Fedora