CVE-2026-74599

A flaw was found in the Linux kernel's memory management subsystem. A race condition exists in the ptdump mechanism, specifically when ptdump_walk_pgd() is used on non-initial memory management structures on x86 and arm64 architectures. This allows for a race between ptdump and kernel page table freeing, potentially leading to system instability or memory corruption.

A moderate-severity flaw was found in the Linux kernel's memory management subsystem, affecting the ptdump page table dumping facility on the x86 and arm64 architectures in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. Kernel page table freeing is performed while an mmap read lock on init_mm is held, but on x86 and arm64 ptdump_walk_pgd() can walk kernel page table ranges through an mm other than init_mm without holding that lock. Since kernel memory ranges are shared across non-kernel mm structures, a local user with the privileges required to trigger the ptdump debug code path could race with concurrent kernel page table freeing, causing the page table dump to traverse page table pages while they are being freed and potentially resulting in memory corruption or a kernel crash (denial of service). There is no impact to the confidentiality or integrity of data. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that release, and Red Hat Enterprise Linux 6 is out of support scope. Because the flawed code path is limited to a kernel debug facility that requires local privileged access to trigger and the practical impact is limited to system availability, Red Hat has deferred the fix for the affected products to a future update; the residual risk is that a sufficiently privileged local user able to trigger the race could crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.