CVE-2026-74600: mm/page_table_check: skip special zero mappings

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/page_table_check: skip special zero mappings

page_table_check_set() and page_table_check_clear() account mappings based
on PageAnon().  Shared zero-page PTEs and huge zero PMDs are special
mappings, but page_table_check can still account them as file-backed
pages.

An unprivileged process can populate enough zero mappings to overflow
file_map_count and hit the existing BUG_ON().  The PTE path can do this
with the shared zero page, and the PMD path can do the same with huge zero
mappings.

Skip special zero mappings in the user page-table accounting paths.  Keep
the PTE-side pte_special() check, and identify huge zero PMDs from the
mapped folio instead of pmd_special().  That covers architectures where
pmd_special() is a no-op without adding huge_zero_pfn checks to the
generic counter helpers.

The Linux kernel CVE team has assigned CVE-2026-74600 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit df4e817b710809425d899340dbfa8504a3ca4ba5 and fixed in 7.1.9 with commit b726eb3c94d23e09da0e0f46b0fa09fb2b5d99cc
	Issue introduced in 5.17 with commit df4e817b710809425d899340dbfa8504a3ca4ba5 and fixed in 7.2 with commit 8db4bab826ccc9ec10fa41736a48031cd338d392

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74600
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/page_table_check.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b726eb3c94d23e09da0e0f46b0fa09fb2b5d99cc
	https://git.kernel.org/stable/c/8db4bab826ccc9ec10fa41736a48031cd338d392