CVE-2026-93230: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit(), but pageallocinitlate() runs earlier and walks pageblocks to determine zone contiguity.

If a bootmem HugeTLB region is marked noinit, setzonecontiguous() can observe still-uninitialized struct pages through pageblockpfntopage(). This may not trigger an immediate failure, but it can make setzonecontiguous() compute the wrong zone contiguity state. If extra poisoned-page checks are added in this path, such as PFPOISONEDCHECK() in pagezoneid(), it can also trigger an early boot panic.

Initialize gigantic bootmem HugeTLB struct pages from pageallocinitlate(), before zone contiguity is evaluated, so later page allocator setup only sees valid struct page state. This also makes the initialization order more natural, as struct pages should be initialized before later code inspects them.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 24, 2026
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
Description
Data Sourced
via NVD·04:17 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems that use gigantic bootmem HugeTLB pages, particularly where a bootmem HugeTLB region is marked noinit, are implicated. The issue occurs during early kernel boot and page allocator initialization.

2

What is the practical impact before the fix is applied?

The kernel can calculate an incorrect zone contiguity state because it inspects uninitialized struct page metadata. With additional poisoned-page validation in that path, the condition can instead cause an early boot panic.

3

Is this remotely exploitable by an unprivileged attacker?

The provided information describes an initialization-order flaw during early boot and does not identify a remote or unprivileged attack path. It depends on the affected HugeTLB bootmem configuration being present.

4

How can administrators determine whether they may be affected?

Review whether the kernel is configured or booted with gigantic bootmem HugeTLB pages and whether any such bootmem HugeTLB region is marked noinit. Also investigate early boot failures or unexpected zone contiguity behavior on systems using that configuration.

5

What mitigation is available if an update cannot be applied immediately?

The provided information does not specify a workaround. Avoiding the affected gigantic bootmem HugeTLB and noinit configuration may reduce exposure, but the documented resolution is to initialize the struct pages before zone contiguity is evaluated.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203