HIGH Introduced in 6.9
hugetlb Reservation Underflow
CVE-2026-89593
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI4.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, the reservation adjustment will result in an underflow of the reserved count. Once the child unmaps the range, the count is restored. Change __unmap_hugepage_range() to check the mapcount before adjusting the reservation.
02KernelScan AI Analysis
Risk summary
A local unprivileged user can cause a hugetlb reservation counter underflow by mapping a huge page, forking, and having the parent unmap before the child. During the underflow window, the reserved huge page can be stolen by another process, causing the original owner to receive SIGBUS on subsequent access. Systems running untrusted local workloads with hugetlb pages configured are most at risk.
Vulnerability analysis
When a huge page is shared between a parent and child process after a fork, unmapping it from the parent releases the reservation too early because the page is still in use by the child. This underflows the reservation counter, briefly allowing another process to take the page and causing the original owner to crash with a bus error when it touches the page again. The corrected code now waits until the page is no longer mapped anywhere before adjusting the reservation. Any local user who can allocate huge pages can trigger the issue through ordinary memory operations; the system must simply have huge pages configured, but no special privileges are required to perform the trigger.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.9 | 6.12.110 | b0b1b9ca80b7 |
| 6.18 | 6.9 | 6.18.50 | a3c65af20cce |
| 7.2 | 6.9 | 7.2.4 | 0f001491e5a2 |
| mainline | 6.9 | 7.3 | 5120b1e048d4 |
| cip/6.12 | 6.9 | 6.12.111-cip32 | b0b1b9ca80b7 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |