UBUNTU-CVE-2026-93230: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit(), but pageallocinitlate() runs earlier and walks pageblocks to determine zone contiguity. If a bootmem HugeTLB region is marked noinit, setzonecontiguous() can observe still-uninitialized struct pages through pageblockpfntopage(). This may not trigger an immediate failure, but it can make setzonecontiguous() compute the wrong zone contiguity state. If extra poisoned-page checks are added in this path, such as PFPOISONEDCHECK() in pagezoneid(), it can also trigger an early boot panic. Initialize gigantic bootmem HugeTLB struct pages from pageallocinitlate(), before zone contiguity is evaluated, so later page allocator setup only sees valid struct page state. This also makes the initialization order more natural, as struct pages should be initialized before later code inspects them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the listed Ubuntu kernel packages when the system uses gigantic bootmem HugeTLB pages and the relevant HugeTLB region is marked noinit. It occurs during early boot-time page allocator initialization.
What is the operational impact?
The kernel can calculate an incorrect zone contiguity state because it inspects uninitialized struct page metadata. With additional poisoned-page validation in this path, the issue can cause an early boot panic.
Does exploitation require an unprivileged attacker or a running service?
The provided information describes an initialization-order flaw during kernel boot, not an attack through a running service. It does not identify any unprivileged attacker prerequisite or remote exploitation path.
How can administrators determine whether they may be affected?
Review whether affected Ubuntu kernel packages are deployed and whether the boot configuration uses gigantic bootmem HugeTLB pages with a HugeTLB region marked noinit. Systems that do not use that configuration are not described as reaching the vulnerable condition.