CVE-2026-68172 Linux CVE debrief

Who should care

Users of the Linux kernel, especially those using the arm64 architecture, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying patches, ensuring the kernel is up to date, and monitoring systems for potential issues. The vulnerability can potentially allow an attacker to access physical memory they don't own, leading to a kernel panic.

Technical summary

The huge_ptep_get function in the Linux kernel can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio. This can lead to incorrect results and potentially allow an attacker to access physical memory they don't own, leading to a kernel panic. The issue is resolved by aligning the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer, to correctly answer whether the huge pte is the base of a contpmd block. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity.

Defensive priority

This vulnerability has a CVSS score of 7.1 and is considered HIGH severity. It is related to the Linux kernel and could potentially allow an attacker to access physical memory they don't own, leading to a kernel panic.

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor systems for potential kernel panics or other issues related to this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is in the Linux kernel, specifically in the arm64 architecture. The issue arises from the huge_ptep_get function being handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio. This can lead to incorrect results and potentially allow an attacker to access physical memory they don't own. The huge_ptep_get() can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio (examples of callers are pagemap_hugetlb_range, page_mapped_in_vma). The arm64 helper rewalks the pgtables in find_num_contig to answer whether the huge pte we have maps a contpmd or a contpte hugetlb folio, and returns CONT_PMDS or CONT_PTES, so that it can collect a/d bits over the contiguous ptes.

Official resources