CVE-2026-74518

Received Received - Intake

Linux Kernel HugeTLB List Corruption Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired. The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips: list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330 ksys_mmap_pgoff+0x2a1/0x3e0 do_syscall_64+0xd7/0x420 Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack address into resv->region_cache, leading to later use-after-free. This was observed as a real host panic on a dense KVM host where a QEMU guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one shared resv_map. Use list_splice_init() so the source head is re-initialized empty after each splice, making the retry loop safe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74518

EUVD

EUVD-2026-59711

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the memory management subsystem affecting hugetlbfs (huge page file system). The bug occurs in allocate_file_region_entries() where a list corruption happens due to improper handling of a temporary list during memory allocation. The function drops a lock to allocate memory, gathers entries on a temporary list, then splices them into the main cache. However, it fails to clear the temporary list head, causing stale pointers that lead to list corruption when the operation is retried concurrently.

Detection Guidance

This vulnerability is specific to the Linux kernel's hugetlb memory management. Detection requires checking for kernel panics or crashes related to list corruption in hugetlb operations. Monitor system logs for BUG messages in lib/list_debug.c or crashes in hugetlb functions. No direct network detection is applicable.

Impact Analysis

This vulnerability can cause kernel panics (system crashes) when certain conditions are met, particularly on systems using hugetlbfs with shared mappings. It may also lead to silent memory corruption that could cause unpredictable behavior or security issues later. Systems running dense virtualization environments (like KVM hosts with QEMU guests) mapping huge pages shared between processes are most at risk.

Compliance Impact

This vulnerability is a kernel-level memory corruption issue in the Linux hugetlbfs subsystem. It does not directly relate to data privacy, access controls, or audit logging required by standards like GDPR or HIPAA. The impact is limited to system stability and potential denial-of-service via kernel panic.

Mitigation Strategies

Apply the kernel patch that replaces list_splice() with list_splice_init() in mm/hugetlb.c. Update to a Linux kernel version containing the fix. If immediate patching is not possible, avoid using MAP_SHARED mappings on hugetlbfs files to reduce exposure.

Hi! I’m here to help you understand CVE-2026-74518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70