Executive brief
The Linux kernel's ptdump (page table dump) utility can race with concurrent kernel page table memory freeing in certain scenarios. When dumping page tables on x86 and ARM64 systems, the utility may access kernel memory regions that are simultaneously being freed, potentially leading to use-after-free conditions or system instability. This patch ensures proper locking is held to eliminate the race.
Technical details
This is a race condition vulnerability in the Linux kernel's mm/ptdump subsystem where kernel page table walking (ptdump) can race with concurrent page table freeing. The vulnerability exists because x86 and arm64 architectures can perform ptdump over memory management structures (mm) other than init_mm via ptdump_walk_pgd(), but kernel memory ranges are shared across all mm structures. This means the existing mmap locking protection for init_mm-specific freeing does not protect these cross-mm operations. The fix acquires a nested mmap write lock on init_mm during ptdump_walk_pgd() to ensure atomicity, with no deadlock risk since init_mm is always locked after the target mm. No exploits in the wild have been reported.
Affected products
- Linux Linux kernel From 4.8 (commit b6bdb7517c3d) through multiple stable branches
Timeline
- 2026-08-22: disclosed: CVE-2026-74599 published