CVE-2026-74672: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74672 Overview

CVE-2026-74672 is a use-after-free (UAF) vulnerability in the Linux kernel's memory management subsystem. The flaw exists in the mm/vmalloc code path and is triggered by a race condition between ptdump page table walking and vmap page table freeing during huge page promotion. When vmap promotes page tables to huge leaf entries, it frees the lower page table without holding a lock that excludes a concurrent ptdump walker, allowing ptdump to dereference freed page table memory.

Critical Impact
Concurrent execution of ptdump and vmap huge page promotion can cause the kernel to access freed page table memory, potentially leading to kernel memory corruption or information disclosure.

Affected Products

Linux kernel (mainline) prior to the fix commits referenced in the kernel Git tree
Linux kernel stable branches receiving the backported patch series
Architectures using vmalloc-huge with ptdump support, notably arm64 and x86

Discovery Timeline

2026-08-22 - CVE-2026-74672 published to NVD
2026-08-23 - Last updated in NVD database

Technical Details for CVE-2026-74672

Vulnerability Analysis

The Linux kernel classifies kernel page table walkers into two categories. Lockless walkers use walk_kernel_page_table_range_lockless() on ranges they wholly own. Walkers requiring exclusion use walk_kernel_page_table_range() or walk_page_range_debug() and rely on the init_mm mmap lock for synchronization.

ptdump is unique because it is the only consumer of walk_page_range_debug() and walks ranges it does not own. Meanwhile, vmap promotes page tables to huge leaf entries where possible, freeing the previous lower-level page table when it does so. This promotion path did not hold any meaningful lock against concurrent ptdump walks. As a result, ptdump could traverse a page table structure while vmap freed it underneath, producing a use-after-free condition.

A related issue affects the x86 Change Page Attributes (CPA) collapse logic, which similarly folds ranges into huge leaf entries and can free page tables while ptdump is walking them. CPA also allowed concurrent page table manipulation during a collapse, risking access to a page table being freed by the collapse path.

Root Cause

The root cause is missing synchronization between page table mutators (vmap huge promotion and x86 CPA collapse) and the ptdump reader. ptdump acquires the init_mm mmap write lock, but the vmap promotion path freed intermediate page tables without acquiring the corresponding read lock, so the two paths could execute concurrently on the same page table memory.

Attack Vector

Exploitation requires the ability to trigger both ptdump walks and vmap huge page promotion in parallel. On systems where ptdump is exposed via debugfs and vmalloc-huge is enabled, a local unprivileged workload that induces vmap activity concurrently with a privileged ptdump reader can race the two paths. The fix in the patch series has the vmap huge promotion path acquire the init_mm mmap read lock while setting the huge PTE and freeing the prior leaf page table, ensuring ptdump observes either the old page table or the new huge entry but never freed memory.

See the kernel commits for the exact code changes: 26444eb71465, 39c6772b56a6, 3cc26c8907db, 7ac8a333dd41, 8d7f560f4b04, and c5bf8cd148cf.

Detection Methods for CVE-2026-74672

Indicators of Compromise

Kernel oops or general protection fault backtraces referencing ptdump_walk_pgd, vmap_pmd_range, or huge page promotion helpers in mm/vmalloc.c.
KASAN use-after-free reports involving freed page table pages accessed during a ptdump walk.
Sporadic kernel crashes correlated with reads of /sys/kernel/debug/page_tables/kernel while vmalloc-heavy workloads are running.

Detection Strategies

Enable KASAN and lockdep on non-production kernels to surface the race and any related synchronization regressions.
Audit running kernel versions across the fleet to identify hosts still on pre-patch stable branches missing the referenced fix commits.
Collect kernel crash dumps and search for stack traces that combine ptdump and vmalloc huge mapping code paths.

Monitoring Recommendations

Ship kernel.log, dmesg, and kdump output to a centralized log or SIEM pipeline to correlate kernel faults across hosts.
Alert on unexpected access to /sys/kernel/debug/page_tables/ on production systems where debugfs should not be routinely read.
Track kernel package versions in configuration management to confirm patched builds are deployed everywhere vmalloc-huge is enabled.

How to Mitigate CVE-2026-74672

Immediate Actions Required

Apply the upstream kernel patch series once packaged by your Linux distribution vendor, prioritizing arm64 and x86 systems that enable vmalloc-huge.
Restrict access to debugfs so that only trusted administrators can trigger ptdump walks, reducing the window in which the race can be induced.
Reboot hosts after patch installation to ensure the fixed mm/vmalloc code path is loaded.

Patch Information

The fix is delivered as a three-patch series in the kernel mm tree. The vmap huge promotion path acquires the init_mm mmap read lock across setting the huge PTE and freeing the prior leaf page table. The prior arm64 workaround introduced in commit fa93b45fd397 is partially reverted to avoid a deadlock with the new locking, and equivalent locking is added to the x86 CPA collapse path. Apply the commits listed in the technical references section from the mainline or stable trees your distribution ships.

Workarounds

Disable vmalloc-huge on affected architectures where operationally acceptable, eliminating the huge promotion path that races with ptdump.
Restrict or unmount debugfs (mount -o remount,mode=0700 /sys/kernel/debug) to prevent unprivileged triggering of ptdump reads.
Avoid running ptdump diagnostics on production systems until patched kernels are deployed.

bash

# Verify kernel version and confirm the patched commit is present
uname -r
git -C /usr/src/linux log --oneline | grep -E '26444eb71465|39c6772b56a6|c5bf8cd148cf'

# Harden debugfs access to reduce ptdump exposure
mount -o remount,mode=0700 /sys/kernel/debug