In the x86-64 architecture, how can the operating system specify which pages cannot contain executable code?

Context: The No-Execute bit or NX bit allows the operating system to specify which pages of virtual address space can contain executable code and which cannot. An attempt to execute code from a page tagged "no execute" will result in a memory access violation, similar to an attempt to write to a read-only page. This should make it more difficult for malicious code to take control of the system via "buffer overrun" or "unchecked buffer" attacks. A similar feature has been available on x86 processors since the 80286 as an attribute of segment descriptors; however, this works only on an entire segment at a time.

Answer: The operating system can tag a page of virtual address space with the No-Execute or NX bit, which is bit 63 of the page table entry.