Linux kernel hugetlb: reservation counter underflow when a parent unmaps a shared huge page first

Impact

Since the change that let __unmap_hugepage_range() adjust reservations, a huge page folio mapped in both a parent and a child underflows the reserved count if the parent unmaps the range first; the count is restored only once the child unmaps. Hugepages are standard on GPU nodes for large-model memory and for VFIO-backed guests, and a transiently wrong reservation count means hugetlb accounting misreports available pages - allocations can be refused or admitted incorrectly during the window. The record describes an accounting bug with a local trigger (fork plus unmap ordering), not memory corruption, and gives no CVSS score or CWE.

Who can reach it

Local unprivileged user on the node who can map a hugetlbfs region and fork; the underflow follows from ordinary unmap ordering between parent and child. No remote path and no privileged access required.

What to do

Patch the host kernel to a stable release that checks mapcount before adjusting the reservation in __unmap_hugepage_range() (commits below), then drain and reboot the node - hugetlb is built into the kernel, so there is no live-patch path in the record. No vendor fixed-version string is given beyond the stable commits.

References

Related entries

• Linux kernel efivarfs: unprivileged statfs() floods the UEFI QueryVariableInfo runtime serviceCVE-2026-89604 · Linux kernel efivarfs (statfs handler, QueryVariableInfo rate limit)Unscored
• Linux CephFS client: unchecked dentry name length overflows a NAME_MAX buffer in the NFS re-export pathCVE-2026-89652 · Linux kernel CephFS client (ceph_get_name / __get_snap_name, NFS-export path)Unscored
• Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmapCVE-2026-89653 · Linux kernel CephFS client (mdsmap decode, export_targets rank validation)Unscored
• Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutexCVE-2026-89654 · Linux kernel CephFS client (check_new_map, MDS session refcounting)Unscored
• Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iterationCVE-2026-89655 · Linux kernel CephFS client (__kick_flushing_caps, cap flush list iteration)Unscored
• Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation bufferCVE-2026-89656 · Linux kernel libceph (crush_decode, bucket id vs array slot validation)Unscored