CVE-2026-68172

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> arm64: make huge_ptep_get handled unaligned addresses<br /> <br /> huge_ptep_get() can be handed a virtual address pointing to the middle<br /> of a contpmd/contpte mapped hugetlb folio (examples of callers are<br /> pagemap_hugetlb_range, page_mapped_in_vma).<br /> <br /> The arm64 helper rewalks the pgtables in find_num_contig to answer<br /> whether the huge pte we have maps a contpmd or a contpte hugetlb folio,<br /> and returns CONT_PMDS or CONT_PTES, so that it can collect a/d bits over<br /> the contiguous ptes. We can falsely return CONT_PTES instead of<br /> CONT_PMDS if the addr is not aligned. On systems where CONT_PTES !=<br /> CONT_PMDS (meaning page size is 16K), we could collect excess A/D bit<br /> state, meaning extra work for the kernel. Even worse, we may iterate<br /> beyond the PTE table and dereference a garbage ptep pointer to access<br /> physical memory we don&amp;#39;t own. Since the ptep pointer is a linear map<br /> address, we may run off the end of the linear map or into a hole,<br /> dereference a VA not mapped into the kernel pgtables and cause kernel<br /> panic.<br /> <br /> Fix this by aligning the pmdp pointer down to a contpmd base before<br /> checking equality with the passed huge pte pointer, to correctly answer<br /> whether the huge pte is the base of a contpmd block.