{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  arm64: mm: call pagetable dtor when freeing hot-removed page tables  Since 5e8eb9aeeda3 (\"arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()\") page-table allocation on ARM64 always calls pagetable_{pte,pmd,pud,p4d}_ctor().  This sets the page_type to PGTY_table, increments NR_PAGETABLE and possible allocates a PTL.  However the matching pagetable_dtor() calls were never added.  With DEBUG_VM enabled on kernel versions prior to v6.17 without 2dfcd1608f3a9 (\"mm/page_alloc: let page freeing clear any set page type\") this leads to the following warning when freeing these pages due to page-\u003epage_type sharing page-\u003e_mapcount:    BUG: Bad page state in process ... pfn:284fbb   page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb   flags: 0x17fffc000000000(node=0|zone=2|lastcpupid=0x1ffff)   page_type: f2(table)   page dumped because: nonzero mapcount   Call trace:    bad_page+0x13c/0x160    __free_frozen_pages+0x6cc/0x860    ___free_pages+0xf4/0x180    free_pages+0x54/0x80    free_hotplug_page_range.part.0+0x58/0x90    free_empty_tables+0x438/0x500    __remove_pgd_mapping.constprop.0+0x60/0xa8    arch_remove_memory+0x48/0x80    try_remove_memory+0x158/0x1d8    offline_and_remove_memory+0x138/0x180  It can also lead to leaking the ptl allocation if ALLOC_SPLIT_PTLOCKS is defined and incorrect NR_PAGETABLE stats.  Fix this by calling pagetable_dtor() in free_hotplug_pgtable_page() prior to freeing the page to undo the effects of calling pagetable_*_ctor().",
  "id": "DEBIAN-CVE-2026-53342",
  "modified": "2026-09-14T16:47:33.301728351Z",
  "published": "2026-07-01T14:16:42.260Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53342"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53342"
  ]
}