Linux kernel mm/hugetlb: rsvd cgroup charge recorded against the wrong cgroup, causing counter underflow

Impact

alloc_hugetlb_folio() reused one h_cg pointer for both the reservation and non-reservation hugetlb cgroup charges, so the folio's rsvd slot stored the non-rsvd cgroup. Freeing the folio then uncharges a cgroup that was never charged, underflowing the page_counter and raising a WARNING in page_counter_cancel(). The practical effect is corrupted hugetlb cgroup accounting: limits stop reflecting reality, which on a GPU node matters because hugepages back pinned host buffers for RDMA and GPU DMA, and per-container hugetlb limits are how operators keep one tenant from starving the others of hugepages. A local user able to allocate hugetlb pages inside a cgroup can drive the mismatch; it is an integrity and availability problem in the accounting path, not a memory-disclosure or privilege-escalation path.

Who can reach it

Local unprivileged user in a cgroup with hugetlb reservations enabled who can map and free hugetlb-backed memory. Authentication to the node (a shell or a pod) is required; not reachable from the network.

What to do

Pick up the stable kernel commits linked in the record (a separate h_cg_rsvd pointer for the reservation path) via your distribution's kernel update. Applying it means booting the patched kernel, so each node must be drained and rebooted. Interim mitigation is to avoid relying on hugetlb cgroup reservation limits for isolation until the patched kernel is in place.

References

Related entries

• Linux kernel (arch/x86/kvm): A guest that disables paravirtual EOI while KVM still has a pending PV-EOI request, andCVE-2026-72284 · Linux kernel (arch/x86/kvm)High
• Linux kernel keyrings: out-of-bounds read in keyring_get_key_chunk() from unprivileged add_key(2)CVE-2026-74567 · Linux kernel keyrings (keyring_get_key_chunk description-level chunk)High
• Linux kernel CXL: oversized header-log size overruns the RAS iomap and leaks kernel stack via tracefsCVE-2026-80662 · Linux kernel CXL RAS capability handling (CXL_HEADERLOG_SIZE, header_log_copy and CPER trace path)High
• Linux kernel KVM arm64 NV: unresolvable VNCR translation crashes the host instead of injecting an abortCVE-2026-80665 · Linux kernel KVM/arm64 nested virtualization (kvm_translate_vncr VNCR abort path)High
• Linux kernel mm: snapshot_page() reads a non-existent tail page for order-1 folios and oopses the hostCVE-2026-80685 · Linux kernel mm/util snapshot_page() (order-1 folio tail-page read)High
• Linux kernel cxl/ras: RCH AER capability copy reads past the mapped register blockCVE-2026-89731 · Linux kernel CXL RAS (cxl_rch_get_aer_info, RCRB AER register copy)High