CVE-2026-93230
Received Received - Intake

Memory Corruption in Linux Kernel HugeTLB

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlb_init(), but page_alloc_init_late() runs earlier and walks pageblocks to determine zone contiguity. If a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can observe still-uninitialized struct pages through __pageblock_pfn_to_page(). This may not trigger an immediate failure, but it can make set_zone_contiguous() compute the wrong zone contiguity state. If extra poisoned-page checks are added in this path, such as PF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot panic. Initialize gigantic bootmem HugeTLB struct pages from page_alloc_init_late(), before zone contiguity is evaluated, so later page allocator setup only sees valid struct page state. This also makes the initialization order more natural, as struct pages should be initialized before later code inspects them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93230
EUVD
EUVD-2026-86235

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper initialization of gigantic bootmem HugeTLB pages. The issue occurs because struct pages for these huge pages are initialized after zone contiguity is evaluated, which can lead to incorrect zone contiguity state detection. This may cause problems if additional checks are added later, potentially triggering a boot panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and may not have direct detection commands. It involves improper initialization of HugeTLB pages during boot. Check kernel logs for boot-time errors or panics related to memory initialization or HugeTLB. Commands like dmesg or journalctl -k may show relevant errors.

Impact Analysis

This vulnerability could cause system instability during boot if extra poisoned-page checks are added. It may lead to incorrect memory zone handling, potentially causing crashes or unexpected behavior in systems using gigantic HugeTLB pages.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel memory management issue that could cause system instability or crashes during boot if uninitialized memory is accessed. Compliance impacts would only occur if such failures disrupted data processing or security controls, which is not specified in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. Monitor kernel release notes for patches addressing CVE-2026-93230. If immediate patching is not possible, avoid using gigantic HugeTLB pages until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93230. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart