CVE-2026-53342

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17

Description On ARM64 architecture, page-table allocation calls constructor functions such as pagetable pte ctor(), pagetable pmd ctor(), pagetable pud ctor(), and pagetable p4d ctor(), which set the page type to PGTY table, increment NR PAGETABLE, and potentially allocate a Page Table Lock (PTL). However, the corresponding destructor calls were missing. When DEBUG VM is enabled, this causes a bad page state warning during the freeing of hot-removed page tables because page->page type shares space with page-> mapcount. Additionally, if ALLOC SPLIT PTLOCKS is defined, this issue can lead to PTL allocation leaks and inaccurate NR PAGETABLE statistics. The issue is triggered within the free hotplug pgtable page() function.

Recommendations Update the Linux kernel to version 6.17 or later. As a temporary mitigation, avoid using the free hotplug pgtable page() function for hot-removing page tables until the system is updated.