CVE-2026-74524

A flaw was found in the Linux kernel. When performing memory hot-remove operations on systems using RISC-V architecture, an out-of-bounds page-table walk can occur. This issue arises because the system attempts to access memory outside of its designated boundaries, potentially leading to a kernel bug and a system crash. This vulnerability could allow a local attacker to cause a denial of service.

A moderate-impact flaw was found in the Linux kernel on the RISC-V architecture. During memory hot-remove, remove_pud_mapping() and remove_p4d_mapping() add a page-table index for the address to a child-table base obtained with pud_offset()/p4d_offset(). Because RISC-V folds page-table levels at runtime (Sv48 folds P4D, and Sv39 folds both P4D and PUD), a folded level's offset helper returns the parent entry itself while the index can still be nonzero, so the computation can walk past the parent table. Memory hot-remove can then descend into unrelated memory and pass an invalid page to __free_pages(), triggering a kernel BUG (for example VM_BUG_ON_PAGE(page_ref_count(page) == 0)) and crashing the system. A local attacker able to trigger memory hot-remove on an affected RISC-V system could use this to cause a denial of service. All Red Hat products currently in scope are marked not affected: Red Hat Enterprise Linux 6 through 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) do not contain the vulnerable code, so no Red Hat shipped product is exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.