{ "cveId": "CVE-2026-64295", "url": "https://patchblox.com/security/cve/CVE-2026-64295", "summary": "CVE-2026-64295 is fixed in 20 products on 1 platform, first by ALAS2023-2026-2045, released August 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_n...", "description": "In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in the hotplug path, it can lead to a NULL pointer dereference during page_ext_lookup at the boundary of the last valid section when iterator count equals __pgcount. The for_each_page_ext() macro calls page_ext_iter_next() as its loop increment. for_each_page_ext() does a \u0022__page_ext = page_ext_iter_next(\u0026__iter)\u0022 at the end. This causes page_ext_iter_next() to increment iter-\u003Eindex past __pgcount and call page_ext_lookup(start_pfn \u002B __pgcount). During memory hotplug (online), the PFN at start_pfn \u002B __pgcount may belong to a section that has not yet been initialized, causing page_ext_lookup() to trigger a NULL pointer dereference. [ 14.555124][ T846] Call trace: [ 14.555125][ T846] lookup_page_ext\u002B0x6c/0x108 (P) [ 14.555127][ T846] page_ext_lookup\u002B0x30/0x3c [ 14.555129][ T846] __reset_page_owner\u002B0x11c/0x260 [ 14.571201][ T846] __free_pages_ok\u002B0x5e8/0x8e0 [ 14.571204][ T846] __free_pages_core\u002B0x78/0xf0 [ 14.571206][ T846] generic_online_page\u002B0x14/0x24 [ 14.597782][ T846] online_pages\u002B0x178/0x30c [ 14.597784][ T846] memory_block_change_state\u002B0x284/0x32c [ 14.597787][ T846] memory_subsys_online\u002B0x4c/0x64 [ 14.597789][ T846] device_online\u002B0x88/0xb0 [ 14.597791][ T846] online_memory_block\u002B0x30/0x40 [ 14.597793][ T846] walk_memory_blocks\u002B0xac/0xe8 [ 14.597794][ T846] add_memory_resource\u002B0x280/0x298 [ 14.656161][ T846] add_memory\u002B0x60/0x98 Move the iteration boundary enforcement inside the iterator functions, so callers cannot inadvertently access beyond the requested range.", "published": "2026-07-25T10:17:10Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.0016, "epssPercentile": 0.05202, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.39-79.141", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.1.4-1", "fix": "DEBIAN-CVE-2026-64295", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64295", "released": "2026-08-07T15:22:10Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }