CVE-2026-74600: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74600 Overview

CVE-2026-74600 is a Linux kernel vulnerability in the mm/page_table_check subsystem. The page_table_check_set() and page_table_check_clear() functions account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, yet page_table_check can incorrectly account them as file-backed pages. An unprivileged local process can populate enough zero mappings to overflow the file_map_count counter and trigger the existing BUG_ON(), halting the affected kernel path.

Critical Impact
An unprivileged local user can trigger a kernel BUG_ON() by overflowing file_map_count through shared zero-page PTE or huge zero PMD mappings, resulting in denial of service on kernels built with CONFIG_PAGE_TABLE_CHECK.

Affected Products

Linux kernel builds with CONFIG_PAGE_TABLE_CHECK enabled
Stable branches referenced by upstream fix commits 7755be9, 8db4bab, and b726eb3
Distributions shipping the affected mm/page_table_check accounting logic

Discovery Timeline

2026-08-22 - CVE-2026-74600 published to NVD
2026-08-23 - Last updated in NVD database

Technical Details for CVE-2026-74600

Vulnerability Analysis

The Linux kernel's page table check facility validates page table modifications to detect memory corruption. It maintains per-page counters tracking anonymous and file-backed mappings. The accounting helpers rely on PageAnon() to differentiate mapping types. Anything not identified as anonymous is treated as file-backed and increments file_map_count.

Shared zero pages and huge zero PMDs represent special read-only mappings backed by a single, kernel-owned page. Because they are neither anonymous nor genuine file-backed pages, they should not participate in mapping accounting. The buggy code path counted every zero mapping against file_map_count for the underlying zero page or zero folio.

An unprivileged process can create very large numbers of shared zero-page mappings by faulting anonymous read-only regions, or huge zero PMD mappings via transparent hugepages. Repeated mappings on the same shared page increment the counter without bound. Once the counter exceeds the maximum tracked value, the kernel's BUG_ON() fires and the task context terminates, degrading system availability.

Root Cause

The root cause is missing filtering for special zero mappings inside page_table_check_set() and page_table_check_clear(). The PTE path lacks an early exit for pte_special() cases mapping the shared zero page. The PMD path lacks equivalent handling for huge zero PMDs, and pmd_special() is a no-op on some architectures, so a folio-based check is required.

Attack Vector

Exploitation requires local code execution as an unprivileged user on a kernel built with page table checking. The attacker allocates memory regions that map the shared zero page or huge zero PMD, then repeats the operation until file_map_count overflows. No network access or elevated privileges are required. The vulnerability is not known to be exploited in the wild, and no public proof-of-concept is listed. The vulnerability manifests only in the kernel accounting path; see the upstream commits 7755be9, 8db4bab, and b726eb3 for the technical fix.

Detection Methods for CVE-2026-74600

Indicators of Compromise

Kernel BUG_ON() panics or oops entries in dmesg referencing page_table_check_set or page_table_check_clear.
Unexpected task termination or system hang originating from mm/page_table_check.c.
Unprivileged processes allocating unusually large read-only anonymous regions backed by the shared zero page.

Detection Strategies

Monitor kernel logs for stack traces containing page_table_check frames alongside overflow-related messages.
Correlate kernel panics with the running kernel build's CONFIG_PAGE_TABLE_CHECK status.
Track processes with anomalous memory mapping counts against the shared zero page via /proc/<pid>/smaps.

Monitoring Recommendations

Ship kernel ring buffer and syslog data to a centralized platform and alert on page_table_check faults.
Baseline per-process anonymous mapping counts and alert on large deviations from unprivileged users.
Track kernel package versions across the fleet to identify hosts still running unpatched builds.

How to Mitigate CVE-2026-74600

Immediate Actions Required

Apply the upstream kernel patches from commits 7755be9, 8db4bab, and b726eb3 or update to a distribution kernel that includes them.
Inventory hosts running kernels built with CONFIG_PAGE_TABLE_CHECK and prioritize patch deployment on multi-tenant systems.
Restrict untrusted local code execution on systems that cannot be immediately patched.

Patch Information

The fix skips special zero mappings in the user page-table accounting paths. It retains the PTE-side pte_special() check and identifies huge zero PMDs from the mapped folio rather than relying on pmd_special(). This approach covers architectures where pmd_special() is a no-op without adding huge_zero_pfn checks to the generic counter helpers. Refer to the kernel.org stable commit 7755be9, commit 8db4bab, and commit b726eb3 for the exact source changes.

Workarounds

Rebuild the kernel with CONFIG_PAGE_TABLE_CHECK disabled if the debugging feature is not required in production.
Constrain untrusted workloads with resource limits and namespaces to reduce the scope of a triggered BUG_ON().
Disable transparent hugepages where huge zero PMD exposure is a concern by setting /sys/kernel/mm/transparent_hugepage/enabled to never.

bash

# Configuration example
# Check whether the running kernel enables page table checking
grep CONFIG_PAGE_TABLE_CHECK /boot/config-$(uname -r)

# Optionally disable transparent hugepages at runtime
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled