Linux kernel x86/mm: vmemmap pages freed as page tables leak memory on memory hot-remove

Impact

After x86 switched non-boot page-table freeing to pagetable_free(), the same helper was still being used to free vmemmap pages. vmemmap pages are not compound pages, so pagetable_free()'s __free_pages(page, compound_order(page)) releases only the first page of a PMD-sized vmemmap allocation and leaks the rest, and the page_ptdesc() treatment of a non-page-table page is wrong to begin with. The result is unreclaimable memory lost on every memory hot-remove, growing with each cycle until the host is rebooted. This is a resource leak, not a memory-safety hole with a tenant-reachable path: only hosts that actually hot-remove memory - CXL capacity, balloon-driven or hotplug-capable VM hosts - accumulate it, and reaching the path takes administrative privilege, not a GPU pod.

Who can reach it

Local privileged operation only - the host's own memory hot-remove path, driven by root or the management plane. No unprivileged local user, guest or tenant path is described in the record.

What to do

Pick up a stable kernel carrying the fix (commits 03f6ecbc446c, 39406c05f8f1, add1e4112e00), which decouples vmemmap freeing from page-table freeing. A kernel update means draining and rebooting each host. Since the leak is only accrued by memory hot-remove, hosts that never hot-remove memory can wait for a routine kernel window rather than an out-of-band one. The kernel CNA's 5.5/AV:L score is its standard assignment for this class, not a measured severity.

References

Related entries

• Linux kernel CTR_DRBG: generate can report success while leaving the output buffer uninitializedCVE-2026-64306 · Linux kernel crypto DRBG (drbg_ctr_generate)Medium
• Linux kernel ccp: /dev/sev ioctls re-run SEV platform init and can crash a host running VMsCVE-2026-64307 · Linux kernel ccp/PSP driver (/dev/sev ioctls re-running SEV/SNP platform init)Medium
• Linux kernel chacha20poly1305 template: missing argument check dereferences an error pointerCVE-2026-64314 · Linux kernel crypto chacha20poly1305 template (chachapoly_create)Medium
• Linux nvmet-rdma: device reference leaks whenever a queue connect is rejected as busyCVE-2026-64321 · Linux kernel nvmet-rdma (device refcount on queue connect)Medium
• Linux kernel BPF verifier: map-in-map lookup nullness elided using the wrong max_entriesCVE-2026-64353 · Linux kernel BPF verifier (ARRAY_OF_MAPS with BPF_F_INNER_MAP inner arrays)Medium
• Linux mm/swap: full-cluster reclaim runs without rescheduling and softlocks large-core-count hostsCVE-2026-64415 · Linux kernel mm/swap (swap_reclaim_full_clusters, missing cond_resched)Medium