Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page table

Impact

When zap_pte_range() reclaims a page table it passes an address one past the end of the range the table covers, so architectures that use the address to flush the paging-structure cache invalidate the wrong entry. If no flush was already pending when the PMD entry was cleared, a CPU can keep a cached reference to the emptied table, which is then freed and can be reused - stale paging-structure state pointing at reallocated memory. The description notes AMD systems are more exposed because EFER.TCE makes INVLPG flush only the target address, and Intel hosts using INVPCID are also affected; this is directly relevant to AMD EPYC-based GPU nodes. The failure mode is memory corruption or unexplained faults under memory pressure, not a clean crash, which makes it expensive to diagnose on a node you cannot cheaply drain.

Who can reach it

Local. Any process performing ordinary unmapping/teardown of address space can hit the path - it does not require privilege - but the bad case depends on a complex flush-accumulation condition, so this reads as a reliability and corruption risk rather than a demonstrated privilege-escalation primitive. The record does not claim a working exploit.

What to do

Apply the stable fix, which corrects the address passed to pte_free_tlb(); the record lists two stable commits. Rolling it out means a patched kernel and a reboot on each node, so drain GPU workloads first. No mitigation or configuration workaround is given in the record.

References

Related entries

• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored
• Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the hostCVE-2026-74703 · Linux kernel vhost-scsi (T10 PI scatterlist count validation)Unscored
• Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command bufferCVE-2026-74712 · Linux kernel mlx5_vdpa (create_direct_keys input buffer length)Unscored
• Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-freeCVE-2026-74714 · Linux kernel BPF TCP iterator (bpf_iter_tcp_established_batch refcount)Unscored
• Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference countCVE-2026-74715 · Linux kernel BPF conntrack kfuncs (opts->netns_id get/put pairing)Unscored
• Linux kernel SMC-R: duplicate LLC link messages from a peer leak one kmalloc-96 object eachCVE-2026-74719 · Linux kernel SMC-R LLC event handler (duplicate CONFIRM_LINK / ADD_LINK_CONT qentry)Unscored