CVE-2026-90283: hugetlbfs: release subpool on fill_super failure
In the Linux kernel, the following vulnerability has been resolved:
hugetlbfs: release subpool on fillsuper failure
hugetlbfsfillsuper() allocates a hugepage subpool when size or minsize mount options are specified. hugepagenewsubpool() may also reserve huge pages for minsize.
If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepageputsubpool() and can leave minsize reservations charged.
Use hugepageputsubpool() on the failure path, matching the normal putsuper path.
Affected Software
Event History
Frequently Asked Questions
Which hugetlbfs mounts can reach the affected cleanup path?
The affected path is used when a hugetlbfs mount specifies the size or min_size mount option, causing a hugepage subpool to be allocated. The issue occurs if root dentry creation then fails during mount setup.
What is the operational impact of the failure?
When min_size has reserved huge pages, freeing the subpool with kfree() can leave those reservations charged. The corrected failure path uses hugepage_put_subpool() so that the subpool and its reservations are released consistently with normal unmount cleanup.