CVE-2026-74672

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable

freeing", v6.

Kernel page table walkers fall into two broad categories - those ranges

where no exclusion is required via walk_kernel_page_table_range_lockless()

and those where exclusion is required via walk_kernel_page_table_range()

or walk_page_range_debug().

The former category is used only by arm64 arch code operating on ranges it

both wholly owns and does not concurrently write.

The latter category consists of kernel page table walkers operating on

ranges that are wholly owned (but which need exclusion against concurrent

writers).

The lock used for exclusion is the mmap lock, and for kernel ranges this

is the mmap lock on init_mm.

ptdump is a special case being both the only user of

walk_page_range_debug(), and the only case in which it walks ranges it

does not own.

Thi

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References