CVE-2026-64295

In the Linux kernel, the following vulnerability has been resolved:

mm: pageext: add count limit to pageextiternext to prevent invalid PFN access

The pageext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in the hotplug path, it can lead to a NULL pointer dereference during pageext_lookup at the boundary of the last valid section when iterator count equals __pgcount.

The foreachpageext() macro calls pageextiternext() as its loop increment. foreachpage_ext() does a "__pageext = pageextiternext(&__iter)" at the end. This causes pageextiter_next() to increment iter->index past __pgcount and call pageextlookup(start_pfn + __pgcount). During memory hotplug (online), the PFN at start_pfn + __pgcount may belong to a section that has not yet been initialized, causing pageextlookup() to trigger a NULL pointer dereference.

[ 14.555124][ T846] Call trace: [ 14.555125][ T846] lookuppageext+0x6c/0x108 (P) [ 14.555127][ T846] pageextlookup+0x30/0x3c [ 14.555129][ T846] __resetpageowner+0x11c/0x260 [ 14.571201][ T846] __freepagesok+0x5e8/0x8e0 [ 14.571204][ T846] __freepagescore+0x78/0xf0 [ 14.571206][ T846] genericonlinepage+0x14/0x24 [ 14.597782][ T846] onlinepages+0x178/0x30c [ 14.597784][ T846] memoryblockchangestate+0x284/0x32c [ 14.597787][ T846] memorysubsysonline+0x4c/0x64 [ 14.597789][ T846] deviceonline+0x88/0xb0 [ 14.597791][ T846] onlinememoryblock+0x30/0x40 [ 14.597793][ T846] walkmemoryblocks+0xac/0xe8 [ 14.597794][ T846] addmemoryresource+0x280/0x298 [ 14.656161][ T846] addmemory+0x60/0x98

Move the iteration boundary enforcement inside the iterator functions, so callers cannot inadvertently access beyond the requested range.