CVE-2026-74632

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix huge_zero_pfn race

Patch series "mm/huge_memory: fix huge_zero_pfn race", v2.

There is a subtle race in the reference-counted huge_zero_folio

implementation.

The fast path atomic logic fails to account for the fact that the shrinker

(which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn

with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a

racing get_huge_zero_folio() installed a valid value there.

This results in huge_zero_folio being correctly set but huge_zero_pfn

being set incorrectly and thus is_huge_zero_pfn() and consequently

is_huge_zero_pmd() will misidentify the huge zero folio as being an

ordinary THP folio.

This can result in the huge zero folio being split and otherwise treated

incorrectly.

The solution to this is very subtle as there is an atomic fast path, and

thus ordering in weakly ordered architectures has to be treated very

carefully.

Th

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References