CVE-2026-74632

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the reference-counted huge zero folio implementation. A race can occur between a shrinker decrementing the reference count to zero in the shrink huge zero folio scan() function and a concurrent page fault in the get huge zero folio() function. If the shrinker is preempted after setting the reference count to zero but before writing an invalid value, get huge zero folio() may install a valid value into huge zero pfn. When the shrinker resumes, it may overwrite huge zero pfn with a sentinel value (~0UL), causing the system to misidentify the huge zero folio as an ordinary Transparent Huge Page (THP) folio. This misidentification can lead to the huge zero folio being incorrectly split or otherwise handled improperly. The issue specifically affects the huge zero pfn variable and is detected by the is huge zero pfn() and is huge zero pmd() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.