CVE-2026-98506

Received Received - Intake

Memory Corruption in Linux Kernel HugeTLB

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/ update_and_free_hugetlb_folio() silently bail for such folios, so it frees a still-listed folio and, on vmemmap restore failure, the add_hugetlb_folio() rollback corrupts the free list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98506

EUVD

EUVD-2026-103746

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	6eb4e88a6d27022ea8aff424d47a0a5dfc9fcb34
Linux	Linux	6eb4e88a6d27022ea8aff424d47a0a5dfc9fcb34
Linux	Linux	6eb4e88a6d27022ea8aff424d47a0a5dfc9fcb34
Linux	Linux	6eb4e88a6d27022ea8aff424d47a0a5dfc9fcb34
Linux	Linux	5.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in handling huge memory pages. The function dissolve_free_hugetlb_folio() fails to check if gigantic huge pages are supported at runtime. This causes it to free a page still listed in the system, leading to corruption of the free list when rollback fails during vmemmap restoration.

Detection Guidance

This vulnerability affects the Linux kernel's handling of huge pages. Detection requires checking kernel logs for hugetlb-related errors or corruption. Monitor for messages like 'add_hugetlb_folio() rollback corrupts the free list' in dmesg or system logs. No specific commands are provided in the context.

Impact Analysis

This vulnerability could cause memory corruption, leading to system crashes, data corruption, or potential privilege escalation. It may also result in instability or unexpected behavior in applications relying on huge pages.

Compliance Impact

This vulnerability affects memory management in the Linux kernel, specifically related to huge pages. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory handling. However, if exploited, it could lead to system instability or crashes, potentially causing service disruptions that might indirectly affect compliance with uptime or availability requirements in regulated environments.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable huge pages if not required by your workload. Monitor kernel updates from your distribution vendor. Restart services using huge pages after patching.

Hi! I’m here to help you understand CVE-2026-98506. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70