CVE-2026-74674

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix incorrect flush address in direct page table reclaim

When zap_pte_range reclaims a page table, it does:

pte_free_tlb(tlb, pmd_pgtable(pmdval), addr);

and this is unconditionally wrong: if this code executes, addr *always*

points one past the end of the range covered by the table. The addr

parameter is used to flush the TLB (really the paging-structure-cache)

to drop references to the to-be-freed table, and any architecture that

cares about the parameter will flush the wrong address. (But they'll

still free the correct page).

I think it's worth contemplating why the kernel works at all.

If we hit the offending line of code, we will first clear the PMD entry

(line 1954, zap_empty_pte_table), then we will issue pending flushes if

force_flush is set (tlb_flush_mmu_tlbonly(tlb)), then we will skip the

retry on line 1979 (phew!), and then we will do the offending

pte_free_tlb call. *Or* we will clear the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References