Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walk

Impact

vmap promotes kernel page tables to huge leaf entries and frees the lower-level table with no lock held against a concurrent ptdump walker, so ptdump can dereference a freed page table. That is a kernel use-after-free on core memory-management structures, which is the class of bug that turns into arbitrary kernel memory corruption rather than a clean crash. The practical reachability is narrow: walk_page_range_debug() has exactly one user, ptdump, which is a debug facility exposed through debugfs and normally not readable by tenants on a production GPU node. On hosts where the kernel debug page-table dump is not enabled or not exposed, there is no way to drive the race.

Who can reach it

Local, and requires the ability to trigger a ptdump page-table walk concurrently with vmalloc huge-mapping activity - in practice root or a user with access to the kernel debugfs ptdump interface. Not reachable from an unprivileged GPU pod on a hardened node with debugfs unmounted or restricted.

What to do

Apply the stable-series fix; the change makes vmap huge promotion take the init_mm mmap read lock across the entry install and the page-table free, and carries a partial revert of the earlier arm64-specific mitigation (commit fa93b45fd397) to avoid a deadlock, so take the full backported series rather than cherry-picking one commit. Deployment is a kernel update and reboot per node, requiring a drain of GPU workloads. Until then, keeping debugfs unmounted or restricted on production nodes removes the only in-tree trigger.

References

Related entries

• Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page tableCVE-2026-74674 · Linux kernel mm (zap_pte_range TLB flush address on direct page-table reclaim)Unscored
• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored
• Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the hostCVE-2026-74703 · Linux kernel vhost-scsi (T10 PI scatterlist count validation)Unscored
• Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command bufferCVE-2026-74712 · Linux kernel mlx5_vdpa (create_direct_keys input buffer length)Unscored
• Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-freeCVE-2026-74714 · Linux kernel BPF TCP iterator (bpf_iter_tcp_established_batch refcount)Unscored
• Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference countCVE-2026-74715 · Linux kernel BPF conntrack kfuncs (opts->netns_id get/put pairing)Unscored