CVE-2026-74524

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove<br /> <br /> remove_pud_mapping() and remove_p4d_mapping() obtain a child table base<br /> with pud_offset(p4dp, 0) and p4d_offset(pgd, 0), then add the index for<br /> addr.<br /> <br /> RISC-V folds page-table levels at runtime. When a level is folded, its<br /> offset helper returns the parent entry itself, but the index can still be<br /> nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39<br /> folds both P4D and PUD, so memory hot-remove can descend into unrelated<br /> memory and pass an invalid page to __free_pages(). This can trigger:<br /> <br /> kernel BUG at include/linux/mm.h:1810!<br /> VM_BUG_ON_PAGE(page_ref_count(page) == 0)<br /> arch_remove_memory+0x1e/0x5c<br /> try_remove_memory+0x15e/0x200<br /> remove_memory+0x24/0x3c<br /> <br /> Only add the index when the corresponding page-table level is enabled,<br /> matching p4d_offset() and pud_offset().