CVE-2026-64295

In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in the hotplug path, it can lead to a NULL pointer dereference during page_ext_lookup at the boundary of the last valid section when iterator count equals __pgcount. The for_each_page_ext() macro calls page_ext_iter_next() as its loop increment. for_each_page_ext() does a "__page_ext = page_ext_iter_next(&__iter)" at the end. This causes page_ext_iter_next() to increment iter->index past __pgcount and call page_ext_lookup(start_pfn + __pgcount). During memory hotplug (online), the PFN at start_pfn + __pgcount may belong to a section that has not yet been initialized, causing page_ext_lookup() to trigger a NULL pointer dereference. [ 14.555124][ T846] Call trace: [ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P) [ 14.555127][ T846] page_ext_lookup+0x30/0x3c [ 14.555129][ T846] __reset_page_owner+0x11c/0x260 [ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0 [ 14.571204][ T846] __free_pages_core+0x78/0xf0 [ 14.571206][ T846] generic_online_page+0x14/0x24 [ 14.597782][ T846] online_pages+0x178/0x30c [ 14.597784][ T846] memory_block_change_state+0x284/0x32c [ 14.597787][ T846] memory_subsys_online+0x4c/0x64 [ 14.597789][ T846] device_online+0x88/0xb0 [ 14.597791][ T846] online_memory_block+0x30/0x40 [ 14.597793][ T846] walk_memory_blocks+0xac/0xe8 [ 14.597794][ T846] add_memory_resource+0x280/0x298 [ 14.656161][ T846] add_memory+0x60/0x98 Move the iteration boundary enforcement inside the iterator functions, so callers cannot inadvertently access beyond the requested range.

• CWE-476

• https://git.kernel.org/stable/c/377b1cd6bbcf327338cd951cc2fd74bc75540235Patch
• https://git.kernel.org/stable/c/8dcaa0f87a88d720d13106f3a306c6b61d189d86Patch
• https://git.kernel.org/stable/c/ffd017237cfe99e6e5602ab14179b0e6878a0840Patch

Published

Jul 25, 2026

Last Modified

Aug 12, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6429When asked to both use a `.netrc` file for credentials and t…5.3
• CVE-2026-64290In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64291In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64292In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64293In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64294In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64296In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64297In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64298In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-64299In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-64300In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64301In the Linux kernel, the following vulnerability has been re…