CVE-2026-74674 Overview
CVE-2026-74674 is a Linux kernel memory management vulnerability in the zap_pte_range function that flushes the wrong Translation Lookaside Buffer (TLB) address during direct page table reclaim. The call to pte_free_tlb(tlb, pmd_pgtable(pmdval), addr) unconditionally passes an address one past the end of the range covered by the freed table. Architectures that rely on the address parameter to invalidate paging-structure caches flush the wrong entry, leaving stale references to a freed page table. The freed table can subsequently be reused, resulting in memory corruption and potential local privilege escalation on affected systems.
Critical Impact
A local attacker with low privileges can trigger stale paging-structure cache entries pointing to freed page tables, leading to memory corruption, information disclosure, or privilege escalation.
Affected Products
- Linux kernel (mainline, prior to fix commits 0b8ff21cbda8 and 478a1c3abebf)
- Distributions shipping affected upstream kernels
- Systems using INVPCID or AMD CPUs with EFER.TCE enabled are most susceptible
Discovery Timeline
- 2026-08-22 - CVE-2026-74674 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74674
Vulnerability Analysis
The defect lives in the memory management subsystem, specifically the zap_pte_range control flow that handles direct page table reclaim. When the kernel decides to free an empty page table, it invokes pte_free_tlb with an addr argument that is expected to identify the virtual range covered by the freed table. In the offending path, addr instead points one past the end of that range. The TLB and paging-structure cache flush therefore targets an address outside the reclaimed table's coverage.
On Intel systems without Kernel Page Table Isolation (KPTI), legacy INVLPG behavior masked the bug because it flushed all paging-structure caches. Modern kernels prefer INVPCID via flush_tlb_one_user, which only invalidates the specified address. AMD systems set the EFER.TCE bit, causing INVLPG itself to flush only the targeted address. Under these conditions, a CPU can retain a cached reference to a freed page table.
Root Cause
The root cause is an off-by-range address argument in the direct page table reclaim path within zap_pte_range. The addr variable used to call pte_free_tlb reflects the loop's terminating address, not the base of the freed table. Combined with the complex control flow around zap_empty_pte_table, tlb_flush_mmu_tlbonly, and zap_pte_table_if_empty, a window exists where the PMD entry is cleared after the last flush of the range. Any CPU may then speculatively populate its paging-structure cache with a reference to the now-empty page table.
Attack Vector
Exploitation requires local access and low privileges. An attacker crafts memory mapping and unmapping patterns that steer zap_pte_range through the vulnerable branch on architectures where the flush address matters. Once the freed table is reallocated for another purpose, the stale paging-structure cache entry can be used to read or write memory through the reused physical page. See the upstream fix commits 0b8ff21cbda8 and 478a1c3abebf for the corrected address handling.
No public proof-of-concept exploit is available. The upstream discussion notes a possible correlation with a ripgrep segfault report.
Detection Methods for CVE-2026-74674
Indicators of Compromise
- Unexplained segmentation faults in long-running processes that heavily mmap and munmap memory, such as file scanners or search tools
- Kernel oops or general protection faults referencing page table walks on AMD hosts or Intel systems using INVPCID
- Memory corruption crashes without matching userspace stack traces
Detection Strategies
- Inventory running kernel versions across the fleet and compare against the fixed commit hashes 0b8ff21cbda8 and 478a1c3abebf
- Correlate host crash telemetry with workloads exercising heavy page table churn on affected kernels
- Review dmesg and kernel crash dumps for repeated faults involving zap_pte_range, pte_free_tlb, or tlb_flush_mmu
Monitoring Recommendations
- Forward kernel logs and crash reports into a centralized data lake for correlation across hosts
- Track process crash rates on Linux endpoints, alerting on statistical deviations that could indicate memory corruption
- Monitor privilege escalation primitives such as new SUID binaries, unexpected uid transitions, and kernel module loads
How to Mitigate CVE-2026-74674
Immediate Actions Required
- Apply vendor-supplied kernel updates that include upstream commits 0b8ff21cbda8 and 478a1c3abebf
- Prioritize patching on AMD systems and Intel systems where INVPCID is used, as these are most susceptible
- Restrict local shell access on multi-tenant hosts until patching completes
Patch Information
The fix is available upstream in the Linux kernel via commits 0b8ff21cbda8 and 478a1c3abebf. Both patches correct the address argument passed to pte_free_tlb so that paging-structure cache flushes target the correct range. Rebuild or pull distribution kernels that include these commits and reboot affected hosts.
Workarounds
- No supported workaround fully closes the flaw; only the upstream patches correct the flush address
- Minimize exposure by tightening local user access controls and enforcing least privilege on shared systems
- Where feasible, monitor for and reboot hosts exhibiting repeated memory corruption crashes on affected kernels
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
