SB20260812373 - Out-of-bounds read in Linux kernel arm64 mm

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-68172)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in huge_ptep_get()/find_num_contig in arch/arm64/mm/hugetlbpage.c when handling unaligned addresses within contpmd/contpte-mapped hugetlb folios. A local user can trigger the kernel to process such an address to cause a denial of service.

This can cause the kernel to iterate beyond the PTE table and dereference an invalid pointer, which may panic the kernel. The issue is specific to arm64 systems, and incorrect CONT_PTES versus CONT_PMDS handling is noted on systems using 16K page size.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/9cd4b1a52eff330798d668c1775f8bc450776280
• https://git.kernel.org/stable/c/f3530aec26563f4d483ff31402392961362e9bc6
• https://git.kernel.org/stable/c/f73a8edc2ccc6ec72c37d5c578e7592d2e1f9922