Executive brief
The Linux kernel's page table checking mechanism incorrectly accounts special zero memory mappings, allowing an unprivileged process to trigger a denial-of-service crash by exhausting internal counters. This affects the memory management subsystem used in all Linux systems and can be exploited without special privileges or network access.
Technical details
The vulnerability exists in mm/page_table_check.c, where the page_table_check_set() and page_table_check_clear() functions fail to skip special zero mappings (shared zero-page PTEs and huge zero PMDs) when accounting file-backed page references. An unprivileged local attacker can populate sufficient zero mappings to overflow the file_map_count counter and trigger a BUG_ON() assertion, causing a kernel panic and denial of service. The root cause is that special mappings are not identified as such before accounting, treating them as regular file-backed pages. The fix adds explicit checks using pte_special() for PTEs and a new page_table_check_huge_zero_pmd() helper for PMDs to skip these mappings during accounting.
Affected products
- Linux Linux kernel 5.1 and later (page_table_check feature)
Timeline
- 2026-08-22: disclosed: Published in NVD
- 2026-08-04: patched: Upstream fix merged
- 2026-08-23: patched: Backported to stable kernels