EUVD-2026-76505
GHSA-xm38-wfrw-x5q7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local-only, deterministic trigger via fork+unmap sequence; no confidentiality impact; reservation underflow enables overcommit (I:H) and kernel instability (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
hugetlb: only adjust reservation during unmapping if mapcount is 0
Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, the reservation adjustment will result in an underflow of the reserved count. Once the child unmaps the range, the count is restored. Change __unmap_hugepage_range() to check the mapcount before adjusting the reservation.
AnalysisAI
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into __unmap_hugepage_range(), the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) local shell access with standard (low) user privileges on the target system; (2) the kernel compiled with CONFIG_HUGETLB_PAGE and the vulnerable code from commit df7a6d1f6405 present (kernel version 6.9 or later, before the fix); (3) the system administrator has allocated huge pages (nr_hugepages > 0 in /proc/sys/vm/); (4) the attacker controls a workload that allocates a hugetlb-backed mmap region, forks a child process (so the folio mapcount reaches ≥ 2), and the parent unmaps before the child, triggering the missing mapcount guard. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is broadly appropriate: local access with low privilege, no user interaction, no confidentiality impact, and high integrity/availability impact from reservation corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Linux kernel to a fixed stable release: 6.18.50, 7.2.4, or 7.3-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine whether your Linux deployments have hugepages enabled and identify which kernel versions are currently running across your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today