---
id: CVE-2026-74600
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/page_table_check: skip special zero mappings

  page_table_check_set() and page_table_check_clear() account mappings based
  on PageAnon()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/page_table_check: skip special zero mappings

  page_table_check_set() and page_table_check_clear() account mappings based
  on PageAnon().  Shared zero-page PTEs and hu…
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74600'
references:
  - url: 'https://git.kernel.org/stable/c/7755be923e325dc300f4b0c3e1ad7e91b28b3cb9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8db4bab826ccc9ec10fa41736a48031cd338d392'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b726eb3c94d23e09da0e0f46b0fa09fb2b5d99cc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00206
epssPercentile: 0.09916
ingestedAt: '2026-10-14T13:30:58.512Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/page_table_check: skip special zero mappings

page_table_check_set() and page_table_check_clear() account mappings based
on PageAnon().  Shared zero-page PTEs and huge zero PMDs are special
mappings, but page_table_check can still account them as file-backed
pages.

An unprivileged process can populate enough zero mappings to overflow
file_map_count and hit the existing BUG_ON().  The PTE path can do this
with the shared zero page, and the PMD path can do the same with huge zero
mappings.

Skip special zero mappings in the user page-table accounting paths.  Keep
the PTE-side pte_special() check, and identify huge zero PMDs from the
mapped folio instead of pmd_special().  That covers architectures where
pmd_special() is a no-op without adding huge_zero_pfn checks to the
generic counter helpers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.