CVE-2026-74674

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the direct page table reclaim process where the zap pte range function uses an incorrect address when calling pte free tlb(). The addr parameter points beyond the end of the range covered by the table, causing the Translation Lookaside Buffer (TLB)—specifically the paging-structure-cache—to flush the wrong address. This can lead to a situation where a CPU caches a reference to an empty page table that is subsequently freed and potentially reused. This behavior is particularly problematic on AMD systems due to the EFER.TCE bit and on Intel systems using INVPCID via flush tlb one user(), as these mechanisms do not flush all paging-structure-caches regardless of the target address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.