CVE-2026-98506: mm/hugetlb: do not dissolve gigantic pages without runtime support
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: do not dissolve gigantic pages without runtime support
dissolvefreehugetlbfolio() doesn't check hstateisgiganticnoruntime(h) though removehugetlbfolio()/ updateandfreehugetlbfolio() silently bail for such folios, so it frees a still-listed folio and, on vmemmap restore failure, the addhugetlbfolio() rollback corrupts the free list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The affected path involves dissolving a gigantic hugetlb folio for an hstate that has no runtime support. Corruption occurs if restoring the vmemmap fails during the subsequent rollback that adds the folio back.
What is the impact if the vulnerable path is triggered?
A folio that remains listed can be freed, and a failed vmemmap restore can cause the add_hugetlb_folio() rollback to corrupt the hugetlb free list.
How can administrators reduce exposure before applying a fix?
Avoid operations that dissolve gigantic hugetlb pages on hstates without runtime support. The supplied information does not identify any other mitigation or configuration change.