CVE-2026-72213

Received Received - Intake

Memory Corruption in Linux Kernel HugeTLB

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set, hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg with the non-rsvd cgroup pointer. As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong (non-rsvd) cgroup pointer into the folio's rsvd slot. When the folio is later freed, free_huge_folio() unconditionally calls both hugetlb_cgroup_uncharge_folio() and hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the wrong cgroup from the folio and decrements a counter that was never charged for that cgroup, causing a page_counter underflow: page_counter underflow: -512 nr_pages=512 WARNING: mm/page_counter.c:61 at page_counter_cancel Fix this by introducing a separate h_cg_rsvd pointer exclusively for the rsvd charge path, keeping the rsvd and non-rsvd charges fully independent through their charge, commit, and error uncharge paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72213

EUVD

EUVD-2026-58971

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a mismatch in hugetlb cgroup charge and uncharge operations. When allocating a huge page, the same pointer is used for both reserved and non-reserved cgroup charges. The reserved charge overwrites the non-reserved pointer, causing the wrong cgroup to be stored for the reserved slot. Later, when freeing the page, the system attempts to uncharge the wrong cgroup, leading to a page counter underflow error.

Detection Guidance

This vulnerability is specific to the Linux kernel's hugetlb cgroup handling and does not have a direct network detection method. Check kernel logs for page_counter underflow warnings or hugetlb-related errors using dmesg or journalctl commands.

Impact Analysis

This vulnerability can cause system instability by triggering page counter underflow errors. It may lead to crashes, memory management issues, or unexpected behavior in systems using hugetlb pages, particularly those with cgroup memory controls enabled.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level memory management issue in the Linux kernel. It may indirectly impact compliance if the affected system is used to process or store regulated data, but the vulnerability itself is not a compliance violation.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this hugetlb cgroup issue. Monitor system logs for page_counter underflow errors as an indicator of exploitation or misconfiguration.

Hi! I’m here to help you understand CVE-2026-72213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70