What is the CVSS score of CVE-2026-72213?

CVE-2026-72213 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72213?

A memory accounting flaw in Linux kernels 5.7 through current versions (CVE-2026-72213) allows local users with low privileges to corrupt kernel memory state, with no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-72213?

Within 24 hours, inventory all systems running Linux kernel versions 5.7 and later to determine current patch levels and identify which systems have hugetlb cgroup functionality enabled. Within 7 days, obtain the vendor-released security patch from your Linux distribution provider and test it in non-production environments to validate system stability and performance. Within 30 days, deploy the patched kernel versions across production systems using your standard change management procedures and scheduled maintenance windows.

Linux Kernel CVE-2026-72213

EUVD-2026-58971 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-cqhp-gwhx-vmwp

Information Disclosure Linux Red Hat Suse

7.1

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Local-only triggering via hugetlb mmap requires low user privilege; no confidentiality impact; corruption of cgroup counters yields high integrity and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:43 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.1 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 7.1

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set, hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg with the non-rsvd cgroup pointer.

As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong (non-rsvd) cgroup pointer into the folio's rsvd slot.

When the folio is later freed, free_huge_folio() unconditionally calls both hugetlb_cgroup_uncharge_folio() and hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the wrong cgroup from the folio and decrements a counter that was never charged for that cgroup, causing a page_counter underflow:

page_counter underflow: -512 nr_pages=512 WARNING: mm/page_counter.c:61 at page_counter_cancel

Fix this by introducing a separate h_cg_rsvd pointer exclusively for the rsvd charge path, keeping the rsvd and non-rsvd charges fully independent through their charge, commit, and error uncharge paths.

AnalysisAI

Page-counter underflow in Linux kernel's hugetlb cgroup accounting allows a local low-privileged user to corrupt memory accounting state, causing integrity and availability impacts on affected systems. The flaw exists in alloc_hugetlb_folio() where a shared h_cg pointer is overwritten during sequential rsvd and non-rsvd hugetlb cgroup charges, causing the wrong cgroup to be committed to the folio's reserved slot. When the folio is freed, the mismatched uncharge path decrements a counter on a cgroup that was never charged, triggering a page_counter underflow (WARNING: mm/page_counter.c:61). No public exploit exists and EPSS sits at 0.21% (11th percentile), but the flaw affects a broad swath of kernel versions from 5.7 onward.

Technical ContextAI

The Linux kernel's huge pages subsystem (hugetlb) integrates with cgroup v2 memory accounting via distinct reserved (rsvd) and non-reserved charge slots per folio. The alloc_hugetlb_folio() function is responsible for charging both slots when allocating a huge page, using hugetlb_cgroup_charge_cgroup_rsvd() and hugetlb_cgroup_charge_cgroup() respectively. The root-cause bug is a variable aliasing logic error: both functions write their output cgroup pointer into the same h_cg variable, so the non-rsvd charge unconditionally clobbers the rsvd cgroup pointer. The fix (introduced in stable commits 5c32ae4a91fb, 15807d0ddde3, 1697d253f51c, b785f2bd9496) introduces a separate h_cg_rsvd variable, fully isolating the two charge paths through charge, commit, and error-uncharge. The CWE is not formally classified in the input data, but the root cause is a classic pointer aliasing / state-clobber logic error. The page_counter underflow manifests as a WARN_ON in mm/page_counter.c:61, which may be non-fatal in production kernels depending on CONFIG_BUG_ON_DATA_CORRUPTION settings, but it corrupts cgroup memory accounting for the life of that cgroup.

RemediationAI

The primary fix is to upgrade to a patched kernel version: 6.12.101 for the 6.12 stable branch, 6.18.40 for the 6.18 stable branch, 7.1.5 for the 7.1 stable branch, or 7.2-rc1 or later for the mainline. Patch commits are available at https://git.kernel.org/stable/c/5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd (and the three sibling commits listed in references). Distributions using their own kernel packages should track upstream stable fixes. For systems that cannot be patched immediately, a targeted compensating control is to disable or avoid using huge pages under cgroup memory accounting: if hugetlb_cgroup is not mounted or huge pages are not allocated via mmap/shmget under a cgroup that enforces hugetlb limits, the vulnerable code path in alloc_hugetlb_folio() with map_chg set is not triggered. Note that disabling huge pages may degrade performance for database workloads (PostgreSQL, Oracle) and JVM-based applications that rely on huge pages for TLB efficiency. No vendor advisory URL beyond the NVD reference (https://nvd.nist.gov/vuln/detail/CVE-2026-72213) was available at time of analysis.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72213 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72213

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code