CVE-2026-74524

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds page-table walk occurs during memory hot-remove in the RISC-V architecture. The functions remove pud mapping() and remove p4d mapping() obtain a child table base using pud offset(p4dp, 0) and p4d offset(pgd, 0), then add the index for addr. Because RISC-V folds page-table levels at runtime, the offset helper may return the parent entry itself while the index remains nonzero, causing the process to walk past the parent table. In Sv48, P4D is folded, and in Sv39, both P4D and PUD are folded. This allows the memory hot-remove process to access unrelated memory and pass an invalid page to free pages(), which can trigger a kernel BUG.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.