CVE-2026-89966: mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio
allocbuddyhugetlbfoliowithmpol() can pass a NULL nodemask to allocfreshhugetlbfolio() as a fallback to allocate from all nodes. If order is gigantic, allocfreshhugetlbfolio() propagates the NULL nodemask down to hugetlbcmaallocfrozenfolio() via allocgiganticfrozenfolio().
Additionally, hugetlbcmaallocfrozenfolio() previously attempted allocation on hugetlbcma[nid] without verifying if nid is included in the caller's nodemask. Adding a nodeisset(nid, nodemask) check ensures the initial preferred node allocation honors the memory policy / nodemask.
However, hugetlbcmaallocfrozenfolio() dereferences the nodemask in nodeisset(nid, nodemask) and foreachnodemask(node, nodemask), leading to a null pointer dereference kernel panic when nodemask is NULL.
Fix this by checking if nodemask is NULL in hugetlbcmaallocfrozenfolio() and defaulting it to cpusetcurrentmemsallowed. Enclose the allocation attempts within the cpuset seqcount retry loop so that if the cpuset changes concurrently during allocation, the attempts are retried using the updated nodemask. This ensures that the initial node check and fallback loop safely honor the task's cpuset without violating cpuset constraints or causing NULL pointer dereferences or unexpected allocation failures.
From a userspace perspective, this bug allows an unprivileged user to crash the kernel (trigger a panic) by requesting a gigantic hugepage allocation with MPOLPREFERREDMANY on a system where CMA is only configured on a subset of NUMA nodes.
This can be reproduced by booting a VM with two NUMA nodes, restricting CMA to Node 1 (e.g., hugetlbcma=1:1G defaulthugepagesz=1G hugepagesz=1G hugepages=0), and running a program that allocates a 1GB hugepage area without reserving, restricts allocation to Node 0 using mbind() with MPOLPREFERREDMANY, and triggers a page fault:
void ptr = mmap(NULL, 1UL << 30, PROTREAD | PROTWRITE, MAPPRIVATE | MAPANONYMOUS | MAPHUGETLB | MAPHUGE1GB | MAPNORESERVE, -1, 0); unsigned long nodemask = 1; / Node 0 / mbind(ptr, 1UL << 30, MPOLPREFERREDMANY, &nodemask, sizeof(nodemask) 8, 0); memset(ptr, 0, 1UL << 30); / Trigger fault /
This results in a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:hugetlbcmaallocfrozenfolio+0x75/0x120 Call Trace: <TASK> onlyallocfreshhugetlbfolio.isra.0+0x2c/0x160 allocsurplushugetlbfolio+0x6d/0x100 allochugetlbfolio+0x3c5/0x660 hugetlbnopage+0x3d9/0x650
Affected Software
Event History
Frequently Asked Questions
Under what allocation conditions can this trigger?
The panic can occur when a huge-page allocation falls back to using all nodes, causing a NULL nodemask to reach hugetlb_cma_alloc_frozen_folio(). The described path specifically involves gigantic-order allocations through alloc_gigantic_frozen_folio().
What is the impact of successful triggering?
A NULL nodemask dereference in the kernel can cause a kernel panic. This is a denial-of-service condition.
How does the fix change behavior when no nodemask is supplied?
The fix substitutes cpuset_current_mems_allowed when the nodemask is NULL. Allocation attempts are also placed inside the cpuset sequence-count retry loop so concurrent cpuset changes are handled during allocation.