CVE-2026-68172: Linux Kernel Privilege Escalation Flaw

CVE-2026-68172 Overview

CVE-2026-68172 is a Linux kernel vulnerability in the arm64 architecture's hugetlb page table handling code. The huge_ptep_get() function fails to correctly handle virtual addresses pointing to the middle of a contpmd or contpte mapped hugetlb folio. On systems with 16K page size, where CONT_PTES differs from CONT_PMDS, the function can falsely return CONT_PTES instead of CONT_PMDS. This mismatch causes the kernel to iterate beyond the page table entry (PTE) table and dereference a garbage pointer into physical memory. The resulting access to an unmapped virtual address in the linear map triggers a kernel panic.

Critical Impact
A local unprivileged user can trigger a kernel panic through operations that call pagemap_hugetlb_range or page_mapped_in_vma on unaligned addresses within contpmd/contpte hugetlb mappings, causing denial of service on arm64 systems using 16K pages.

Affected Products

Linux kernel on arm64 architecture
Systems configured with 16K page size where CONT_PTES != CONT_PMDS
Kernels using hugetlb with contiguous PTE/PMD mappings

Discovery Timeline

2026-08-10 - CVE-2026-68172 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68172

Vulnerability Analysis

The vulnerability resides in the arm64-specific huge_ptep_get() helper, which is invoked by callers such as pagemap_hugetlb_range and page_mapped_in_vma. These callers may pass a virtual address pointing to the middle of a contpmd or contpte mapped hugetlb folio rather than to its base. To determine whether the huge PTE maps a contpmd or contpte hugetlb folio, the helper rewalks the page tables through find_num_contig and returns either CONT_PMDS or CONT_PTES so it can aggregate access and dirty (A/D) bits across the contiguous PTEs.

When the address is not aligned to a contpmd base, the comparison logic incorrectly classifies the mapping. On systems with matching CONT_PTES and CONT_PMDS values, this produces only excess kernel work. On 16K page size configurations where the two constants differ, the kernel iterates past the end of the PTE table and dereferences arbitrary memory.

Root Cause

The root cause is a missing alignment step before the equality check against the passed huge PTE pointer. The pmdp pointer is not aligned down to a contpmd base prior to comparison, so the helper cannot reliably determine whether the huge PTE marks the base of a contpmd block. This is a kernel-level out-of-bounds read that resolves into an invalid linear map dereference.

Attack Vector

Exploitation requires local access with low privileges. Because ptep in the arm64 linear map may point past the end of the linear map or into a hole, the kernel can dereference a virtual address not mapped into its own page tables. The result is a fatal exception in kernel mode, producing a kernel panic and full system denial of service. No user interaction is required, and the impact is limited to availability, with high confidentiality impact from potential kernel memory reads before the panic condition manifests.

No verified exploitation code examples are available. See the kernel commits 9cd4b1a, f3530ae, and f73a8ed for the technical fix details.

Detection Methods for CVE-2026-68172

Indicators of Compromise

Unexpected kernel panics on arm64 systems configured with 16K page size, particularly stack traces referencing huge_ptep_get, find_num_contig, pagemap_hugetlb_range, or page_mapped_in_vma.
Kernel oops messages showing invalid virtual address dereferences originating from linear map addresses during hugetlb page table walks.

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for panic signatures involving arm64 hugetlb path functions.
Audit running kernel versions across arm64 fleets and compare against the patched commits 9cd4b1a52eff, f3530aec2656, and f73a8edc2ccc.
Correlate unexpected reboots with workloads that use hugetlb mappings, pagemap scans, or memory introspection tools such as page-types.

Monitoring Recommendations

Enable persistent kernel crash dump collection (kdump) on arm64 hosts to capture stack traces from any triggered panic.
Track process activity that reads /proc/*/pagemap on systems with hugetlb-backed workloads, as this path invokes the affected pagemap_hugetlb_range caller.
Alert on repeated unplanned reboots of arm64 nodes running database, HPC, or containerized workloads that rely on huge pages.

How to Mitigate CVE-2026-68172

Immediate Actions Required

Apply the upstream kernel patches referenced by commits Kernel Git Commit 9cd4b1a, Kernel Git Commit f3530ae, and Kernel Git Commit f73a8ed.
Prioritize arm64 hosts configured with 16K page size, where the out-of-bounds dereference is reachable.
Restrict local, unprivileged access to systems that cannot be patched immediately.

Patch Information

The fix aligns the pmdp pointer down to a contpmd base before comparing it against the passed huge PTE pointer. This ensures find_num_contig correctly identifies whether the huge PTE is the base of a contpmd block. Distribution vendors are expected to backport the three referenced stable commits into supported kernel branches. Rebuild and reboot arm64 systems after applying updated kernel packages.

Workarounds

Where feasible, boot affected arm64 hosts with a 4K page size configuration, since the out-of-bounds condition only manifests when CONT_PTES != CONT_PMDS.
Limit access to interfaces that trigger pagemap_hugetlb_range, such as unprivileged reads of /proc/<pid>/pagemap, until patches are deployed.
Reduce reliance on hugetlb-backed allocations on unpatched arm64 systems where operationally acceptable.

bash

# Verify kernel version and arm64 page size configuration
uname -r
getconf PAGE_SIZE

# Check whether hugetlb is in active use
grep -i huge /proc/meminfo

# Restrict unprivileged pagemap access as a temporary hardening step
sysctl -w kernel.pagemap_privileged=1