Executive brief
The Linux kernel incorrectly flushes the CPU's translation lookaside buffer (TLB) when freeing page tables during memory management operations. This can leave stale references to freed memory in the CPU cache, potentially allowing an attacker to exploit the dangling reference for privilege escalation or to crash the system. The issue is most easily triggered on systems using INVPCID or AMD processors with TCE enabled.
Technical details
This is a memory management bug in the zap_pte_range() function of the Linux kernel's mm subsystem. When the kernel frees a page table during page reclamation, it calls pte_free_tlb() with an address parameter that points one past the end of the range covered by that table. This incorrect address is used to flush the TLB and paging-structure-cache, meaning the flush targets the wrong address. While the correct page table is still freed, a CPU can speculatively cache a reference to the now-freed (empty) page table. On x86 systems using INVPCID or AMD systems with EFER.TCE enabled, flushing the wrong address does not invalidate the speculative cache entry, leaving a use-after-free condition. Exploitation requires specific architectural conditions and is rare but possible through speculative execution or under specific memory pressure conditions. The fix involves correcting the address parameter passed to pte_free_tlb().
Affected products
- Linux Linux kernel multiple versions prior to fix
Timeline
- 2026-08-22: disclosed
- patched: Fix resolves the incorrect flush address issue