CVE-2026-93230: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit(), but pageallocinitlate() runs earlier and walks pageblocks to determine zone contiguity.
If a bootmem HugeTLB region is marked noinit, setzonecontiguous() can observe still-uninitialized struct pages through pageblockpfntopage(). This may not trigger an immediate failure, but it can make setzonecontiguous() compute the wrong zone contiguity state. If extra poisoned-page checks are added in this path, such as PFPOISONEDCHECK() in pagezoneid(), it can also trigger an early boot panic.
Initialize gigantic bootmem HugeTLB struct pages from pageallocinitlate(), before zone contiguity is evaluated, so later page allocator setup only sees valid struct page state. This also makes the initialization order more natural, as struct pages should be initialized before later code inspects them.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that use gigantic bootmem HugeTLB pages, particularly where a bootmem HugeTLB region is marked noinit, are implicated. The issue occurs during early kernel boot and page allocator initialization.
What is the practical impact before the fix is applied?
The kernel can calculate an incorrect zone contiguity state because it inspects uninitialized struct page metadata. With additional poisoned-page validation in that path, the condition can instead cause an early boot panic.
Is this remotely exploitable by an unprivileged attacker?
The provided information describes an initialization-order flaw during early boot and does not identify a remote or unprivileged attack path. It depends on the affected HugeTLB bootmem configuration being present.
How can administrators determine whether they may be affected?
Review whether the kernel is configured or booted with gigantic bootmem HugeTLB pages and whether any such bootmem HugeTLB region is marked noinit. Also investigate early boot failures or unexpected zone contiguity behavior on systems using that configuration.
What mitigation is available if an update cannot be applied immediately?
The provided information does not specify a workaround. Avoiding the affected gigantic bootmem HugeTLB and noinit configuration may reduce exposure, but the documented resolution is to initialize the struct pages before zone contiguity is evaluated.