CVE-2026-74599 Overview
CVE-2026-74599 is a race condition in the Linux kernel mm/ptdump subsystem. The kernel enforces an invariant that kernel page table freeing occurs while an mmap read lock on init_mm is held. That invariant prevents races between ptdump and kernel page table freeing. However, on x86 and arm64, ptdump_walk_pgd() can operate on an mm other than init_mm. Because kernel memory ranges are shared across non-kernel mm structures, the race still occurs in those paths. A concurrent walker can observe page tables that are being freed, leading to unstable state during debug dumps.
Critical Impact
Concurrent ptdump operations against a non-init_mm address space can race kernel page table freeing on x86 and arm64, undermining page-table stability guarantees.
Affected Products
- Linux kernel mm/ptdump subsystem
- x86 architecture builds exposing ptdump_walk_pgd()
- arm64 architecture builds exposing ptdump_walk_pgd()
Discovery Timeline
- 2026-08-22 - CVE-2026-74599 published to NVD
- 2026-08-23 - Last updated in NVD database
Technical Details for CVE-2026-74599
Vulnerability Analysis
The issue is a race condition [CWE-362] between the page table dump path and the kernel page table freeing path. Prior fixes required callers freeing kernel page tables to hold an mmap read lock on init_mm. That guarantee only stabilises walkers that dump init_mm directly. On x86 and arm64, ptdump_walk_pgd() accepts an arbitrary mm. Kernel address ranges are mirrored across every process mm, so a walker operating on a non-kernel mm still traverses shared kernel page tables. Without an init_mm lock during that walk, another CPU can free intermediate page tables while the dump is in flight.
Root Cause
The root cause is missing synchronisation against init_mm in ptdump_walk_pgd() when the walk targets a non-init_mm address space. The fix acquires a nested mmap write lock on init_mm inside ptdump_walk_pgd() after locking the target mm. Lock ordering is safe because no other path acquires the init_mm lock before an arbitrary mm lock, so deadlock is not possible. The fix also updates walk_page_range_debug() to assert that init_mm is write locked, removes redundant code, and eliminates an unnecessary call to walk_kernel_page_table_range(). The regression window begins with commit b6bdb7517c3d ("mm/vmalloc: add interfaces to free unmapped page table"), which is the referenced Fixes tag.
Attack Vector
Exploitation requires local access to trigger ptdump operations, typically via debugfs interfaces such as /sys/kernel/debug/page_tables/. These interfaces are usually restricted to privileged users. Concurrent workloads that cause kernel page table freeing (for example vmalloc/vfree churn) increase the race window. The primary observable impact is kernel instability during debug dumps rather than a direct remote code execution path. See the upstream commits, including Kernel Git Commit 27c32e5 and Kernel Git Commit cbd9583b, for the exact locking changes.
Detection Methods for CVE-2026-74599
Indicators of Compromise
- Unexplained kernel oops or NULL pointer dereference stack traces referencing ptdump_walk_pgd, walk_page_range_debug, or page table walk helpers.
- Kernel logs showing faults concurrent with vfree activity or debugfs page table dump access.
- Non-root users granted access to /sys/kernel/debug/ on production systems.
Detection Strategies
- Enumerate deployed kernel versions and compare against the fix commits published on git.kernel.org for the mm/ptdump series.
- Audit access controls on debugfs mount points and any tooling that invokes kernel page table dumps.
- Correlate crash dumps with the call sites ptdump_walk_pgd() and walk_page_range_debug() to identify affected hosts.
Monitoring Recommendations
- Monitor kernel ring buffer and journald for oops or warnings originating in mm/ptdump.c.
- Track processes reading debugfs page table interfaces and alert on non-administrative principals.
- Capture kernel version telemetry from Linux endpoints to prioritise unpatched hosts.
How to Mitigate CVE-2026-74599
Immediate Actions Required
- Apply the upstream Linux kernel patches that add the nested init_mm write lock in ptdump_walk_pgd() and update walk_page_range_debug() assertions.
- Restrict access to debugfs, in particular the page table dump interfaces, to the root user only.
- Reboot into the patched kernel after installation to activate the corrected locking.
Patch Information
The fix is distributed across the following stable branches and mainline commits: Kernel Git Commit 27c32e5, Kernel Git Commit 3c0391b, Kernel Git Commit 4adc4c9, Kernel Git Commit 76df4ed, Kernel Git Commit 7f74066, Kernel Git Commit b9c6d04, and Kernel Git Commit cbd9583b. Consume the corresponding distribution kernel update once your vendor backports the change.
Workarounds
- Unmount or disable debugfs on production nodes where kernel page table dumps are not required.
- Remove read access to page table dump files under /sys/kernel/debug/ for all non-root users.
- Avoid running third-party diagnostic tools that invoke ptdump_walk_pgd() on non-init_mm address spaces until patched.
# Restrict debugfs to root only until the kernel is patched
mount -o remount,mode=700 /sys/kernel/debug
# Verify running kernel version and compare against distro advisory
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
