CVE-2026-64295

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access

The page_ext iteration API does not validate if the PFN still belongs to a

valid section while advancing the iterator. When dynamically adding

memory in the hotplug path, it can lead to a NULL pointer dereference

during page_ext_lookup at the boundary of the last valid section when

iterator count equals __pgcount.

The for_each_page_ext() macro calls page_ext_iter_next() as its loop

increment. for_each_page_ext() does a "__page_ext =

page_ext_iter_next(&__iter)" at the end. This causes page_ext_iter_next()

to increment iter->index past __pgcount and call page_ext_lookup(start_pfn

+ __pgcount). During memory hotplug (online), the PFN at start_pfn +

__pgcount may belong to a section that has not yet been initialized,

causing page_ext_lookup() to trigger a NULL pointer dereference.

[ 14.555124][ T846] Call trace:

[ 14.555125][ T

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References