143 lines
7.4 KiB
JSON
143 lines
7.4 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-53342",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-06-09T07:44:35.399Z",
|
|
"datePublished": "2026-07-01T13:32:23.449Z",
|
|
"dateUpdated": "2026-07-01T13:32:23.449Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-07-01T13:32:23.449Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: call pagetable dtor when freeing hot-removed page tables\n\nSince 5e8eb9aeeda3 (\"arm64: mm: always call PTE/PMD ctor in\n__create_pgd_mapping()\") page-table allocation on ARM64 always calls\npagetable_{pte,pmd,pud,p4d}_ctor(). This sets the page_type to\nPGTY_table, increments NR_PAGETABLE and possible allocates a PTL. However\nthe matching pagetable_dtor() calls were never added.\n\nWith DEBUG_VM enabled on kernel versions prior to v6.17 without\n2dfcd1608f3a9 (\"mm/page_alloc: let page freeing clear any set page type\")\nthis leads to the following warning when freeing these pages due to\npage->page_type sharing page->_mapcount:\n\n BUG: Bad page state in process ... pfn:284fbb\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb\n flags: 0x17fffc000000000(node=0|zone=2|lastcpupid=0x1ffff)\n page_type: f2(table)\n page dumped because: nonzero mapcount\n Call trace:\n bad_page+0x13c/0x160\n __free_frozen_pages+0x6cc/0x860\n ___free_pages+0xf4/0x180\n free_pages+0x54/0x80\n free_hotplug_page_range.part.0+0x58/0x90\n free_empty_tables+0x438/0x500\n __remove_pgd_mapping.constprop.0+0x60/0xa8\n arch_remove_memory+0x48/0x80\n try_remove_memory+0x158/0x1d8\n offline_and_remove_memory+0x138/0x180\n\nIt can also lead to leaking the ptl allocation if ALLOC_SPLIT_PTLOCKS is\ndefined and incorrect NR_PAGETABLE stats. Fix this by calling\npagetable_dtor() in free_hotplug_pgtable_page() prior to freeing the page\nto undo the effects of calling pagetable_*_ctor()."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"arch/arm64/mm/mmu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5e8eb9aeeda3a7aaf48efa1d34ae804e894e307f",
|
|
"lessThan": "95f27fcda681021ed3906d3cae7e68b6a57a1d8e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e8eb9aeeda3a7aaf48efa1d34ae804e894e307f",
|
|
"lessThan": "aaa688ac9f18207f7452c6472e647c1febaea6a3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e8eb9aeeda3a7aaf48efa1d34ae804e894e307f",
|
|
"lessThan": "c594b83457ccdee76d458416fb3bc9348a37592f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"arch/arm64/mm/mmu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.16",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.16",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.36",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.13",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.16",
|
|
"versionEndExcluding": "6.18.36"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.16",
|
|
"versionEndExcluding": "7.0.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.16",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/95f27fcda681021ed3906d3cae7e68b6a57a1d8e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/aaa688ac9f18207f7452c6472e647c1febaea6a3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c594b83457ccdee76d458416fb3bc9348a37592f"
|
|
}
|
|
],
|
|
"title": "arm64: mm: call pagetable dtor when freeing hot-removed page tables",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |