Linux kernel page_table_check: unprivileged zero mappings overflow the file map counter and panic the host

Impact

page_table_check_set()/clear() classify mappings by PageAnon(), so shared zero-page PTEs and huge zero PMDs get counted as file-backed. An unprivileged process can map enough of them to overflow file_map_count and hit the existing BUG_ON(), taking the kernel down. Where page_table_check is enabled as a hardening measure, any tenant with a shell in a container can panic the whole node - the GPUs on it included - and every co-tenant job dies with it. The mitigation intended to catch page-table corruption becomes the denial-of-service primitive.

Who can reach it

Local, unprivileged, no special capability or device access: ordinary anonymous read-only mappings that resolve to the shared zero page, plus the huge-zero PMD path. Only affects kernels built with CONFIG_PAGE_TABLE_CHECK and the feature actually enabled (it is off by default on most distro kernels unless turned on at boot).

What to do

Install the patched kernel from the linked stable commits, which skip special zero mappings in the user page-table accounting paths, and reboot each node. Where a reboot cannot be scheduled immediately, turning page_table_check off at boot removes the BUG_ON entirely - it is a debug/hardening feature, not a functional dependency - but that is itself a reboot.

References

Related entries

• KVM SVM SEV: races between encryption-context move and copy corrupt the mirror list and misdirect a VM referenceCVE-2026-74607 · KVM SVM SEV (owner/mirror VM list serialisation across MOVE_ENC_CONTEXT_FROM and COPY_ENC_CONTEXT_FROM)Unscored
• Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplugCVE-2026-74637 · Linux kernel perf/core (perf_group_detach sibling promotion)Unscored
• Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.imaCVE-2026-74671 · Linux kernel IMA (xattr_verify digest-length check)Unscored
• Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walkCVE-2026-74672 · Linux kernel mm/vmalloc (huge vmap promotion vs ptdump page-table walk)Unscored
• Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page tableCVE-2026-74674 · Linux kernel mm (zap_pte_range TLB flush address on direct page-table reclaim)Unscored
• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored