CVE-2026-64302 x86/mm: Fix freeing of PMD-sized vmemmap pages
A memory leak in the Linux kernel x86/mm subsystem occurs when freeing PMD-sized vmemmap pages, potentially leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64302?
CVE-2026-64302 is a medium-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix freeing of PMD-sized vmemmap pages
Commit bf9e4e30f353 ("x86/mm: use pagetable_free()"), switched from freeing non-boot page tables through __free_pages() to pagetable_free().
However, the function is also called to free vmemmap pages.
Given that vmemmap pages are not page tables, already the page_ptdesc(page) is wrong. But worse, pagetable_free() calls:
__free_pages(page, compound_order(page));
Since vmemmap pages are not compound pages (see vmemmap_alloc_block()) -- except for HVO, which doesn't apply here -- only first page of a PMD-sized vmemmap page is freed, leaking the other ones.
Fix it by properly decoupling pagetable and vmemmap freeing. free_pagetable() no longer has to mess with SECTION_INFO, as only the vmemmap is marked like that in register_page_bootmem_memmap().
The indentation in remove_pmd_table() is messed up. Fix that while touching it.
Bootmem info handling will soon be fixed up. For now, handle it similar to free_pagetable(), just avoiding the ifdef.
[ dhansen: changelog munging. More imperative voice ]
Which versions are affected by CVE-2026-64302?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64302?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64302 being exploited?
There is no known exploitation of CVE-2026-64302 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-64302, GHSA-rmr6-r8pg-m34q, ROOT-OS-UBUNTU-2204-CVE-2026-64302, UBUNTU-CVE-2026-64302.