The Linux kernel had a vulnerability in its mm/page_table_check component where special zero mappings, such as shared zero-page PTEs and huge zero PMDs, were incorrectly accounted as file-backed pages by page_table_check_set() and page_table_check_clear(). This misaccounting allowed an unprivileged process to create enough zero mappings to overflow the file_map_count counter and cause a kernel BUG_ON() to be hit, potentially leading to a denial of service. The patch skips these special zero mappings in the user page-table accounting paths, maintaining checks on PTE-side special pages and identifying huge zero PMDs from the mapped folio instead of relying on pmd_special(), thus preventing the overflow condition.

An unprivileged user could cause the kernel to hit a BUG_ON() by overflowing the file_map_count through specially crafted zero mappings. This likely results in a denial of service via kernel crash or panic. There is no indication of privilege escalation or code execution from the provided data.

A fix has been implemented in the Linux kernel to skip special zero mappings in the user page-table accounting paths, preventing the overflow of file_map_count. Users should update their Linux kernel to a version that includes this patch once available. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel release notes or security advisories for the exact fixed versions and update guidance.