CVE-2026-93232
Received Received - Intake

Memory Corruption in Linux Kernel HugeTLB

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and device DAX" [1]. It collects the first 19 patches of that series as a standalone set of fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup. The first patches fix a few bugs found while reviewing the existing code, including incorrect bootmem HVO handling, wrong vmemmap registration arguments, a powerpc compound-vmemmap tracking bug, and too-late initialization of gigantic bootmem HugeTLB struct pages. The rest of the series reorders early memory initialization so the relevant zone state is available before sparse and HugeTLB boot-time setup runs, then simplifies the remaining bootmem gigantic hugepage allocation path and removes code made obsolete by that rework. At a high level: - patches [1-4] fix boot-time and arch-specific bugs - patches [5-12] reorder and simplify sparse/mm/hugetlb early init - patches [13-19] refactor bootmem gigantic hugepage allocation and remove obsolete helpers and state This patch (of 19): Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[]. Those shared tail pages were initialized in hugetlb_vmemmap_init(), but bootmem HugeTLB folios are prepared earlier from gather_bootmem_prealloc(). With hugetlb_free_vmemmap=on, prep_and_add_bootmem_folios() can access pageblock flags on bootmem HugeTLB pages whose mirrored tail struct pages already point to the shared tail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then dereferences the still-uninitialized shared tail page and can panic during boot. Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before bootmem HugeTLB folios are processed, and drop the later initialization from hugetlb_vmemmap_init(). This bug only affects CONFIG_DEBUG_VM kernels, where the relevant assertion is evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93232
EUVD
EUVD-2026-86237

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel causes a boot panic when both CONFIG_DEBUG_VM and HVO bootmem pages are enabled. It occurs because shared tail pages in zone->vmemmap_tails[] are initialized too late during boot. When accessing pageblock flags on bootmem HugeTLB pages, the kernel dereferences uninitialized shared tail pages, triggering an assertion failure in CONFIG_DEBUG_VM kernels.

Detection Guidance

This vulnerability only affects Linux kernels with CONFIG_DEBUG_VM enabled and involves a boot-time panic related to HugeTLB page handling. Detection requires checking kernel configuration and boot logs. No network detection methods are applicable.

Impact Analysis

This vulnerability causes the system to fail during boot, preventing normal operation. It only affects systems with specific kernel configurations (CONFIG_DEBUG_VM enabled and HVO bootmem pages used), typically during early boot stages before the system fully initializes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel boot-time panic issue specific to CONFIG_DEBUG_VM kernels, causing system instability during initialization. No data exposure or privacy implications are associated with this flaw.

Mitigation Strategies

Apply the kernel patch series that fixes this issue. If CONFIG_DEBUG_VM is enabled, ensure your kernel version includes the fix for bootmem HugeTLB handling. Rebuild and reboot the system with the patched kernel.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart