CVE-2026-74600

In the Linux kernel, the following vulnerability has been resolved:

mm/page_table_check: skip special zero mappings

page_table_check_set() and page_table_check_clear() account mappings based

on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special

mappings, but page_table_check can still account them as file-backed

pages.

An unprivileged process can populate enough zero mappings to overflow

file_map_count and hit the existing BUG_ON(). The PTE path can do this

with the shared zero page, and the PMD path can do the same with huge zero

mappings.

Skip special zero mappings in the user page-table accounting paths. Keep

the PTE-side pte_special() check, and identify huge zero PMDs from the

mapped folio instead of pmd_special(). That covers architectures where

pmd_special() is a no-op without adding huge_zero_pfn checks to the

generic counter helpers.