CVE-2026-89593: hugetlb: only adjust reservation during unmapping if mapcount is 0

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

hugetlb: only adjust reservation during unmapping if mapcount is 0

Since df7a6d1f6405, unmaphugepagerange can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, the reservation adjustment will result in an underflow of the reserved count. Once the child unmaps the range, the count is restored. Change unmaphugepagerange() to check the mapcount before adjusting the reservation.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Update the Linux kernel hugetlb logic so that __unmap_hugepage_range adjusts the reservation only during unmapping when mapcount is 0 (i.e., check mapcount before adjusting the reservation to avoid reserved-count underflow).

    Linux kernel hugetlb __unmap_hugepage_range reservation adjustment condition = only adjust reservation during unmapping if mapcount is 0

Event History

Sep 11, 2026
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the reservation-count underflow?

A huge-page folio must be mapped by both a parent and child, and the parent must unmap the range before the child. In that order, reservation adjustment during the parent's unmap can underflow the reserved count until the child later unmaps.

2

How can I tell whether a kernel is affected?

The issue is associated with kernels containing commit df7a6d1f6405 and lacking the change that makes __unmap_hugepage_range() check mapcount before adjusting reservations. The provided stable-kernel references identify commits containing the resolution.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203