CVE-2026-89593

CVE-2026-89593 is a flaw in the Linux kernel's hugetlb (huge page) subsystem: since commit df7a6d1f6405, __unmap_hugepage_range() adjusts the hugepage reservation count without first checking whether the folio is still mapped by another process. When a huge page is mapped in both a parent and a child (e.g., after fork) and the parent unmaps the range first, the reservation adjustment underflows the reserved-page count, corrupting kernel memory accounting until the child also unmaps and restores the value. A local, low-privileged attacker can trigger this with ordinary huge-page mapping/unmapping operations to corrupt reservation accounting, with the CVSS 3.1 score of 7.1 reflecting high impact on integrity and availability (e.g., bypassing reservation limits, exhausting huge pages, or destabilizing the system) and no confidentiality impact. Affected systems are those running kernels that contain the behavior introduced in df7a6d1f6405 and that use hugetlb huge pages, which are common on database, virtualization, and HPC hosts; exploitation requires local code execution, not remote access. No public proof of concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.

What to do: Patch to a kernel that includes the fix (which makes __unmap_hugepage_range() verify the folio mapcount before adjusting reservations) as soon as your distribution ships it, prioritizing huge-page-enabled hosts. In the interim, restrict untrusted local accounts on systems with hugetlb configured and monitor /proc/meminfo's HugePages_Rsvd for anomalous or underflowed values. Check whether your environment actually uses huge pages (vm.nr_hugepages sysctl, hugetlbfs mounts) to gauge real exposure, since the vulnerability requires local access and hugepage usage to trigger.