CVE-2026-68172

In the Linux kernel, the following vulnerability has been resolved:

arm64: make hugeptepget handled unaligned addresses

hugeptepget() can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio (examples of callers are pagemaphugetlbrange, pagemappedin_vma).

The arm64 helper rewalks the pgtables in findnumcontig to answer whether the huge pte we have maps a contpmd or a contpte hugetlb folio, and returns CONTPMDS or CONTPTES, so that it can collect a/d bits over the contiguous ptes. We can falsely return CONTPTES instead of CONTPMDS if the addr is not aligned. On systems where CONTPTES != CONTPMDS (meaning page size is 16K), we could collect excess A/D bit state, meaning extra work for the kernel. Even worse, we may iterate beyond the PTE table and dereference a garbage ptep pointer to access physical memory we don't own. Since the ptep pointer is a linear map address, we may run off the end of the linear map or into a hole, dereference a VA not mapped into the kernel pgtables and cause kernel panic.

Fix this by aligning the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer, to correctly answer whether the huge pte is the base of a contpmd block.