CVE-2026-98729: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Don't apply vaalign to hugetlb mappings on AMD F15h
getalignmask() returns hugepagemaskalign() for hugetlbfs, but getalignbits() adds vaalign.bits regardless, so vmunmappedarea() returns an address off the huge page boundary and unmaphugepagerange() hits BUGON(start & ~hugepagemask(h)) at teardown.
This can be triggered on Carrizo and FX-8370E, both hstates.
Pass the file to getalignbits() and skip the randomisation for hugetlbfs.
[ bp: Massage commit message. ]
Affected Software
Event History
Frequently Asked Questions
Which systems are affected?
The issue is reported as triggerable on AMD Family 15h systems, specifically Carrizo and FX-8370E processors, when using hugetlbfs mappings. It affects both huge-page hstates.
What is required to trigger the failure?
A hugetlbfs mapping must be placed through the affected virtual-address alignment path on the listed AMD systems. The resulting address can be off the huge-page boundary, causing a BUG_ON during huge-page mapping teardown.
What happens when the issue is triggered?
Teardown reaches __unmap_hugepage_range() with an improperly aligned start address and hits its BUG_ON assertion. The provided data indicates a kernel failure condition rather than disclosure or corruption details.