In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 ("x86/mm: use… (CVE-2026-64302)
A vulnerability in the Linux kernel related to improper freeing of PMD-sized vmemmap pages has been resolved. The issue arose from using a function intended for freeing page tables to free vmemmap pages, which are not page tables, causing partial freeing and memory leaks. The fix properly separates the freeing logic for page tables and vmemmap pages to prevent resource leaks.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64302 involves incorrect memory management in the x86 memory management code. Specifically, the commit bf9e4e30f353 changed the freeing of non-boot page tables to use pagetable_free(), which was also incorrectly applied to vmemmap pages. Since vmemmap pages are not compound pages, only the first page of a PMD-sized vmemmap page was freed, leaking the remaining pages. The fix decouples the freeing mechanisms for page tables and vmemmap pages, ensuring proper memory release and correcting related code indentation issues.
Potential Impact
The vulnerability causes memory leaks in the kernel's virtual memory map management on x86 architectures. While no direct exploitation or active attacks are reported, leaking kernel memory can degrade system stability and potentially increase the attack surface for other vulnerabilities.
Mitigation Recommendations
A fix has been applied in the Linux kernel source to properly handle freeing of PMD-sized vmemmap pages. Users should update to a kernel version that includes this fix once it is released. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 ("x86/mm: use… (CVE-2026-64302)
Description
A vulnerability in the Linux kernel related to improper freeing of PMD-sized vmemmap pages has been resolved. The issue arose from using a function intended for freeing page tables to free vmemmap pages, which are not page tables, causing partial freeing and memory leaks. The fix properly separates the freeing logic for page tables and vmemmap pages to prevent resource leaks.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64302 involves incorrect memory management in the x86 memory management code. Specifically, the commit bf9e4e30f353 changed the freeing of non-boot page tables to use pagetable_free(), which was also incorrectly applied to vmemmap pages. Since vmemmap pages are not compound pages, only the first page of a PMD-sized vmemmap page was freed, leaking the remaining pages. The fix decouples the freeing mechanisms for page tables and vmemmap pages, ensuring proper memory release and correcting related code indentation issues.
Potential Impact
The vulnerability causes memory leaks in the kernel's virtual memory map management on x86 architectures. While no direct exploitation or active attacks are reported, leaking kernel memory can degrade system stability and potentially increase the attack surface for other vulnerabilities.
Mitigation Recommendations
A fix has been applied in the Linux kernel source to properly handle freeing of PMD-sized vmemmap pages. Users should update to a kernel version that includes this fix once it is released. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rmr6-r8pg-m34q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64302"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420d9c2644c7f8085cf1
Added to database: 07/25/2026, 23:09:01 UTC
Last enriched: 07/25/2026, 23:36:24 UTC
Last updated: 07/26/2026, 04:11:42 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.