CVE-2026-74632

Local system instability via huge-zero-page race

Published Aug 22, 2026 · Updated Aug 25, 2026

Race condition in Linux kernel mm/huge_memory.c allows local users to trigger system instability through concurrent huge zero page handling. The shrinker can set huge_zero_refcount to zero and later overwrite huge_zero_pfn with ~0UL after a racing page fault installs a valid folio and PFN, so THP checks misclassify that folio. Reachability requires CONFIG_PERSISTENT_HUGE_ZERO_FOLIO to be disabled and a narrow interleaving between shrinker reclamation and a page fault; the documented consequence is incorrect splitting or other mishandling of the huge zero folio.

CVSS severity7.8
High
EPSS probability0.13%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Race condition in Linux kernel mm/huge_memory.c allows local users to trigger system instability through concurrent huge zero page handling. The shrinker can set huge_zero_refcount to zero and later overwrite huge_zero_pfn with ~0UL after a racing page fault installs a valid folio and PFN, so THP checks misclassify that folio. Reachability requires CONFIG_PERSISTENT_HUGE_ZERO_FOLIO to be disabled and a narrow interleaving between shrinker reclamation and a page fault; the documented consequence is incorrect splitting or other mishandling of the huge zero folio.

The record

CVE
CVE-2026-74632
Published
Aug 22, 2026
Updated
Aug 25, 2026
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
CWE-367
Attack vector
local
Privileges
authenticated

Timeline

How it unfolded

  1. Aug 22, 2026CVE publishedPublication date reported by the CVE source.
  2. Aug 25, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <105d04edbec83010df5728f74d17fd9c108e7553
  2. Affected versionversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb
  3. Affected versionversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3
  4. Affected versionversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <9332b080ad57650d1dc582e54517f9fc78ef89cc
  5. Affected versionversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <ab7e4b407c7f58d1a003134eff3841f303d5ccc2
  6. Affected versionversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <f3a874a903053c53fb53ba287ea9eacda69c68e8
  7. Affected versionversion=4.19.197 <4.20
  8. Affected versionversion=5.10.47 <5.11
  9. Affected versionversion=5.12.14 <5.13
  10. Affected versionversion=5.13
  11. Affected versionversion=5.4.129 <5.5
  12. Affected versionversion=6527d8ef68c3ca3c455e38ae2a37cd7810caec73
  13. Affected versionversion=b1daf8f862136894a4595770a44e4508808fb806
  14. Affected versionversion=bd092a0f19423d7e9e81182314a96ecd6a14f3b7
  15. Affected versionversion=fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8

What conditions does exploitation require?

Attack vectorlocal
Required privilegesauthenticated

What is affected?

The Linux Kernel Organization · Linuxversion=3b77e8c8cde581dadab9a0f1543a347e24315f11 <105d04edbec83010df5728f74d17fd9c108e7553; version=3b77e8c8cde581dadab9a0f1543a347e24315f11 <33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb; version=3b77e8c8cde581dadab9a0f1543a347e24315f11 <6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3; version=3b77e8c8cde581dadab9a0f1543a347e24315f11 <9332b080ad57650d1dc582e54517f9fc78ef89cc; version=3b77e8c8cde581dadab9a0f1543a347e24315f11 <ab7e4b407c7f58d1a003134eff3841f303d5ccc2; version=3b77e8c8cde581dadab9a0f1543a347e24315f11 <f3a874a903053c53fb53ba287ea9eacda69c68e8; version=4.19.197 <4.20; version=5.10.47 <5.11; version=5.12.14 <5.13; version=5.13; version=5.4.129 <5.5; version=6527d8ef68c3ca3c455e38ae2a37cd7810caec73; version=b1daf8f862136894a4595770a44e4508808fb806; version=bd092a0f19423d7e9e81182314a96ecd6a14f3b7; version=fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8

Published CVSS scores

7.8Linux kernel CVE teamCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 9, 2026Sep 15, 2026
Latest reporting daySep 15, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
Privilegesauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo