{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64295", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.778Z", "datePublished": "2026-07-25T08:49:33.194Z", "dateUpdated": "2026-08-17T04:52:52.693Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:52:52.693Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access\n\nThe page_ext iteration API does not validate if the PFN still belongs to a\nvalid section while advancing the iterator. When dynamically adding\nmemory in the hotplug path, it can lead to a NULL pointer dereference\nduring page_ext_lookup at the boundary of the last valid section when\niterator count equals __pgcount.\n\nThe for_each_page_ext() macro calls page_ext_iter_next() as its loop\nincrement. for_each_page_ext() does a \"__page_ext =\npage_ext_iter_next(&__iter)\" at the end. This causes page_ext_iter_next()\nto increment iter->index past __pgcount and call page_ext_lookup(start_pfn\n+ __pgcount). During memory hotplug (online), the PFN at start_pfn +\n__pgcount may belong to a section that has not yet been initialized,\ncausing page_ext_lookup() to trigger a NULL pointer dereference.\n\n[ 14.555124][ T846] Call trace:\n[ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P)\n[ 14.555127][ T846] page_ext_lookup+0x30/0x3c\n[ 14.555129][ T846] __reset_page_owner+0x11c/0x260\n[ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0\n[ 14.571204][ T846] __free_pages_core+0x78/0xf0\n[ 14.571206][ T846] generic_online_page+0x14/0x24\n[ 14.597782][ T846] online_pages+0x178/0x30c\n[ 14.597784][ T846] memory_block_change_state+0x284/0x32c\n[ 14.597787][ T846] memory_subsys_online+0x4c/0x64\n[ 14.597789][ T846] device_online+0x88/0xb0\n[ 14.597791][ T846] online_memory_block+0x30/0x40\n[ 14.597793][ T846] walk_memory_blocks+0xac/0xe8\n[ 14.597794][ T846] add_memory_resource+0x280/0x298\n[ 14.656161][ T846] add_memory+0x60/0x98\n\nMove the iteration boundary enforcement inside the iterator functions, so\ncallers cannot inadvertently access beyond the requested range."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/page_ext.h"], "versions": [{"version": "9039b9096ea27a20f0349d1537537663c935c8ed", "lessThan": "8dcaa0f87a88d720d13106f3a306c6b61d189d86", "status": "affected", "versionType": "git"}, {"version": "9039b9096ea27a20f0349d1537537663c935c8ed", "lessThan": "377b1cd6bbcf327338cd951cc2fd74bc75540235", "status": "affected", "versionType": "git"}, {"version": "9039b9096ea27a20f0349d1537537663c935c8ed", "lessThan": "ffd017237cfe99e6e5602ab14179b0e6878a0840", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/page_ext.h"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8dcaa0f87a88d720d13106f3a306c6b61d189d86"}, {"url": "https://git.kernel.org/stable/c/377b1cd6bbcf327338cd951cc2fd74bc75540235"}, {"url": "https://git.kernel.org/stable/c/ffd017237cfe99e6e5602ab14179b0e6878a0840"}], "title": "mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/page_ext.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8dcaa0f87a88d720d13106f3a306c6b61d189d86", "status": "affected", "version": "9039b9096ea27a20f0349d1537537663c935c8ed", "versionType": "git"}, {"lessThan": "377b1cd6bbcf327338cd951cc2fd74bc75540235", "status": "affected", "version": "9039b9096ea27a20f0349d1537537663c935c8ed", "versionType": "git"}, {"lessThan": "ffd017237cfe99e6e5602ab14179b0e6878a0840", "status": "affected", "version": "9039b9096ea27a20f0349d1537537663c935c8ed", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/page_ext.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1DA3E752-10DF-4260-A04E-FB6A07086768", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access\n\nThe page_ext iteration API does not validate if the PFN still belongs to a\nvalid section while advancing the iterator. When dynamically adding\nmemory in the hotplug path, it can lead to a NULL pointer dereference\nduring page_ext_lookup at the boundary of the last valid section when\niterator count equals __pgcount.\n\nThe for_each_page_ext() macro calls page_ext_iter_next() as its loop\nincrement. for_each_page_ext() does a \"__page_ext =\npage_ext_iter_next(&__iter)\" at the end. This causes page_ext_iter_next()\nto increment iter->index past __pgcount and call page_ext_lookup(start_pfn\n+ __pgcount). During memory hotplug (online), the PFN at start_pfn +\n__pgcount may belong to a section that has not yet been initialized,\ncausing page_ext_lookup() to trigger a NULL pointer dereference.\n\n[ 14.555124][ T846] Call trace:\n[ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P)\n[ 14.555127][ T846] page_ext_lookup+0x30/0x3c\n[ 14.555129][ T846] __reset_page_owner+0x11c/0x260\n[ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0\n[ 14.571204][ T846] __free_pages_core+0x78/0xf0\n[ 14.571206][ T846] generic_online_page+0x14/0x24\n[ 14.597782][ T846] online_pages+0x178/0x30c\n[ 14.597784][ T846] memory_block_change_state+0x284/0x32c\n[ 14.597787][ T846] memory_subsys_online+0x4c/0x64\n[ 14.597789][ T846] device_online+0x88/0xb0\n[ 14.597791][ T846] online_memory_block+0x30/0x40\n[ 14.597793][ T846] walk_memory_blocks+0xac/0xe8\n[ 14.597794][ T846] add_memory_resource+0x280/0x298\n[ 14.656161][ T846] add_memory+0x60/0x98\n\nMove the iteration boundary enforcement inside the iterator functions, so\ncallers cannot inadvertently access beyond the requested range."}], "id": "CVE-2026-64295", "lastModified": "2026-08-17T05:17:29.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-25T10:17:10.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/377b1cd6bbcf327338cd951cc2fd74bc75540235"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8dcaa0f87a88d720d13106f3a306c6b61d189d86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ffd017237cfe99e6e5602ab14179b0e6878a0840"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access", "id": "2507174", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507174"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's memory management (mm) component, specifically within the `page_ext` iteration application programming interface (API). When memory is dynamically added to the system (a process known as 'hotplugging'), the API does not properly validate memory page frame numbers (PFNs). This oversight can lead to a null pointer dereference, potentially causing a system crash or denial of service (DoS) if an attacker can trigger memory hotplug operations."], "name": "CVE-2026-64295", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64295\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64295\nhttps://lore.kernel.org/linux-cve-announce/2026072505-CVE-2026-64295-29f9@gregkh/T"], "threat_severity": "Low"}