CVE-2026-64302

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix freeing of PMD-sized vmemmap pages

Commit bf9e4e30f353 ("x86/mm: use pagetable_free()"), switched from

freeing non-boot page tables through __free_pages() to

pagetable_free().

However, the function is also called to free vmemmap pages.

Given that vmemmap pages are not page tables, already the page_ptdesc(page)

is wrong. But worse, pagetable_free() calls:

__free_pages(page, compound_order(page));

Since vmemmap pages are not compound pages (see vmemmap_alloc_block())

-- except for HVO, which doesn't apply here -- only first page of a

PMD-sized vmemmap page is freed, leaking the other ones.

Fix it by properly decoupling pagetable and vmemmap freeing.

free_pagetable() no longer has to mess with SECTION_INFO, as only the

vmemmap is marked like that in register_page_bootmem_memmap().

The indentation in remove_pmd_table() is messed up. Fix that while

touching it.

Bootmem info handling will soon be fixed

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References