CVE-2026-74600

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/page_table_check: skip special zero mappings<br /> <br /> page_table_check_set() and page_table_check_clear() account mappings based<br /> on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special<br /> mappings, but page_table_check can still account them as file-backed<br /> pages.<br /> <br /> An unprivileged process can populate enough zero mappings to overflow<br /> file_map_count and hit the existing BUG_ON(). The PTE path can do this<br /> with the shared zero page, and the PMD path can do the same with huge zero<br /> mappings.<br /> <br /> Skip special zero mappings in the user page-table accounting paths. Keep<br /> the PTE-side pte_special() check, and identify huge zero PMDs from the<br /> mapped folio instead of pmd_special(). That covers architectures where<br /> pmd_special() is a no-op without adding huge_zero_pfn checks to the<br /> generic counter helpers.