The Linux kernel vulnerability CVE-2026-74674 involves an incorrect address used in the zap_pte_range function when reclaiming page tables. Specifically, the pte_free_tlb call flushes the TLB at an address one past the end of the page table range, which is incorrect. This can cause CPUs to retain cached references to freed page tables, potentially leading to segmentation faults or speculative execution hazards. The impact varies by architecture: on x86 systems without KPTI, the flush instruction (INVLPG) flushes all paging-structure caches, mitigating the issue; however, on AMD systems and Intel systems using INVPCID, the flush only affects the target address, increasing risk. The flaw was fixed by correcting the flush address to ensure proper TLB invalidation. The complexity of the zap_pte_range control flow contributed to the bug. This vulnerability may explain certain observed crashes in software like ripgrep. No active exploitation is known.

If triggered, the vulnerability can cause CPUs to cache stale references to freed page tables, which may result in segmentation faults or speculative execution of invalid memory references. On some architectures, this could lead to system instability or security risks related to speculative execution. However, on many x86 systems, the impact is mitigated by the behavior of the INVLPG instruction. AMD systems and Intel systems using INVPCID are more vulnerable. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include the corrected flush address in zap_pte_range to ensure proper TLB invalidation. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or kernel mailing list advisories for the exact fixed kernel versions and apply updates accordingly.