In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: restore reservation on error in hugetlb folio copy paths
Two sites in mm/hugetlb.c allocate a hugetlb folio via
alloc_hugetlb_folio() (consuming a VMA reservation) and then call
copy_user_large_folio(), which became int-returning in commit 1cb9dc4b475c
("mm: hwpoison: support recovery from HugePage copy-on-write faults") and
can now fail (e.g. -EHWPOISON on a hwpoisoned source page). On the
failure path, folio_put() restores the global hugetlb pool count through
free_huge_folio(), but the per-VMA reservation map entry is left marked
consumed:
- hugetlb_mfill_atomic_pte() resubmission path (UFFDIO_COPY)
- copy_hugetlb_page_range() fork-time CoW path when
hugetlb_try_dup_anon_rmap() fails (rare: pinned hugetlb anon
folio under fork)
User-visible effect: on UFFDIO_COPY into a private hugetlb VMA where the
resubmission copy fails, the reservation for that address is leaked from
the VMA's reserve map. A subsequent fault at the same address takes the
no-reservation path, and under hugetlb pool pressure the task is SIGBUSed
at an address it had previously reserved. The fork-time CoW path leaks
the same way in the child VMA's reserve map, though it requires the much
rarer combination of pinned hugetlb anon page + hwpoisoned source.
Add the missing restore_reserve_on_error() call before folio_put() on both
error paths.
References
Configurations
Configuration 1 (hide)
|
History
07 Jul 2026, 20:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/40c81856e622a9dc59294a90d169ac07ea25b0b0 - Patch | |
| References | () https://git.kernel.org/stable/c/45e33d43243d71d089af42f5077b8213cee6610f - Patch | |
| References | () https://git.kernel.org/stable/c/8d6e1dd3ad1340cd8b6d554b7aa93d8f0a1c6d38 - Patch | |
| References | () https://git.kernel.org/stable/c/c72469ac0f274bde3f0df60a4584e14a123d0aa6 - Patch | |
| References | () https://git.kernel.org/stable/c/e47bf16af3c45470ea32f2241fa69aefe0dd61bd - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
|
| CWE | CWE-772 |
25 Jun 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 09:16
Updated : 2026-07-07 20:12
NVD link : CVE-2026-53154
Mitre link : CVE-2026-53154
CVE.ORG link : CVE-2026-53154
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-772
Missing Release of Resource after Effective Lifetime