CVE-2026-53342

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: mm: call pagetable dtor when freeing hot-removed page tables

Since 5e8eb9aeeda3 ("arm64: mm: always call PTE/PMD ctor in

__create_pgd_mapping()") page-table allocation on ARM64 always calls

pagetable_{pte,pmd,pud,p4d}_ctor(). This sets the page_type to

PGTY_table, increments NR_PAGETABLE and possible allocates a PTL. However

the matching pagetable_dtor() calls were never added.

With DEBUG_VM enabled on kernel versions prior to v6.17 without

2dfcd1608f3a9 ("mm/page_alloc: let page freeing clear any set page type")

this leads to the following warning when freeing these pages due to

page->page_type sharing page->_mapcount:

BUG: Bad page state in process ... pfn:284fbb

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb

flags: 0x17fffc000000000(node=0|zone=2|lastcpupid=0x1ffff)

page_type: f2(table)

page dumped because: nonzero mapcount

Call trace:

bad_page+0x13c/0x160

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References