CVE-2026-93232

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages

Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4.

This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and device DAX" [1]. It collects the first 19 patches of that series as a standalone set of fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup.

The first patches fix a few bugs found while reviewing the existing code, including incorrect bootmem HVO handling, wrong vmemmap registration arguments, a powerpc compound-vmemmap tracking bug, and too-late initialization of gigantic bootmem HugeTLB struct pages.

Leer descripción completaMostrar menos

The rest of the series reorders early memory initialization so the relevant zone state is available before sparse and HugeTLB boot-time setup runs, then simplifies the remaining bootmem gigantic hugepage allocation path and removes code made obsolete by that rework.

This patch (of 19):

Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].

Those shared tail pages were initialized in hugetlb_vmemmap_init(), but bootmem HugeTLB folios are prepared earlier from gather_bootmem_prealloc(). With hugetlb_free_vmemmap=on, prep_and_add_bootmem_folios() can access pageblock flags on bootmem HugeTLB pages whose mirrored tail struct pages already point to the shared tail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then dereferences the still-uninitialized shared tail page and can panic during boot.

Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before bootmem HugeTLB folios are processed, and drop the later initialization from hugetlb_vmemmap_init().

This bug only affects CONFIG_DEBUG_VM kernels, where the relevant assertion is evaluated.

Detalles técnicos trazas, registros y código del informe original

At a high level:
  - patches [1-4] fix boot-time and arch-specific bugs
  - patches [5-12] reorder and simplify sparse/mm/hugetlb early init
  - patches [13-19] refactor bootmem gigantic hugepage allocation and
    remove obsolete helpers and state

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.15%
Percentil entre todas las CVEs puntuadas: 4
Fecha de la puntuación: 4/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-93232",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "622026e87c4019e609010811757e31193cc23847",
              "lessThan": "2ddf429e25cf8415d9c308f07e64012026bd4d77",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "622026e87c4019e609010811757e31193cc23847",
              "lessThan": "c0caeceb0c3899dc42844d3979093b27d1434108",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "mm/hugetlb.c",
            "mm/hugetlb_vmemmap.c",
            "mm/sparse-vmemmap.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "mm/hugetlb.c",
            "mm/hugetlb_vmemmap.c",
            "mm/sparse-vmemmap.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T16:17:18.767",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2ddf429e25cf8415d9c308f07e64012026bd4d77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c0caeceb0c3899dc42844d3979093b27d1434108",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages\n\nPatch series \"mm: Refactor bootmem gigantic hugepage allocation\", v4.\n\nThis series is split out from the earlier larger series \"mm: Generalize\nHVO for HugeTLB and device DAX\" [1].  It collects the first 19 patches of\nthat series as a standalone set of fixes and preparatory cleanups around\nbootmem HugeTLB handling, sparse initialization ordering, and related\nvmemmap setup.\n\nThe first patches fix a few bugs found while reviewing the existing code,\nincluding incorrect bootmem HVO handling, wrong vmemmap registration\narguments, a powerpc compound-vmemmap tracking bug, and too-late\ninitialization of gigantic bootmem HugeTLB struct pages.\n\nThe rest of the series reorders early memory initialization so the\nrelevant zone state is available before sparse and HugeTLB boot-time setup\nruns, then simplifies the remaining bootmem gigantic hugepage allocation\npath and removes code made obsolete by that rework.\n\nAt a high level:\n  - patches [1-4] fix boot-time and arch-specific bugs\n  - patches [5-12] reorder and simplify sparse/mm/hugetlb early init\n  - patches [13-19] refactor bootmem gigantic hugepage allocation and\n    remove obsolete helpers and state\n\n\nThis patch (of 19):\n\nCommit 622026e87c40 (\"mm/hugetlb: remove fake head pages\") switched\nHVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].\n\nThose shared tail pages were initialized in hugetlb_vmemmap_init(), but\nbootmem HugeTLB folios are prepared earlier from\ngather_bootmem_prealloc().  With hugetlb_free_vmemmap=on,\nprep_and_add_bootmem_folios() can access pageblock flags on bootmem\nHugeTLB pages whose mirrored tail struct pages already point to the shared\ntail page.  On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then\ndereferences the still-uninitialized shared tail page and can panic during\nboot.\n\nInitialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before\nbootmem HugeTLB folios are processed, and drop the later initialization\nfrom hugetlb_vmemmap_init().\n\nThis bug only affects CONFIG_DEBUG_VM kernels, where the relevant\nassertion is evaluated."
    }
  ],
  "lastModified": "2026-09-24T16:17:18.767",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}