CVE-2026-46284: mm/hugetlb: fix early boot crash on parameters without '=' separator
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix early boot crash on parameters without '=' separator
If hugepages, hugepagesz, or defaulthugepagesz are specified on the kernel command line without the '=' separator, early parameter parsing passes NULL to hugetlbaddparam(), which dereferences it in strlen() and can crash the system during early boot.
Reject NULL values in hugetlbaddparam() and return -EINVAL instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If hugepages, hugepagesz, or default_hugepagesz are specified on the Linux kernel command line, ensure they use the '=' separator (avoid specifying these parameters without an '='), because early parameter parsing can pass NULL to hugetlb_add_param() and cause an early boot crash.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46284?
CVE-2026-46284 has a risk rating of 34, indicating its potential impact on system stability.
How do I fix CVE-2026-46284?
To fix CVE-2026-46284, ensure that hugepages, hugepagesz, or default_hugepagesz parameters specified on the kernel command line include the '=' separator.
What does CVE-2026-46284 affect?
CVE-2026-46284 affects the early boot process of the Linux kernel related to hugepage configurations.
When was CVE-2026-46284 published?
CVE-2026-46284 was published on June 8, 2026.
What causes the issue in CVE-2026-46284?
The issue in CVE-2026-46284 is caused by early parameter parsing passing NULL to the hugetlb functions when parameters are missing the '=' separator.