From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8832B3E316F for ; Fri, 8 May 2026 13:15:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778246102; cv=none; b=gynoDpnzfW6d0qUbux6qDK/Me9630kYMBO5OY43MlCep/MCvdNG851B4bN19F8JY3PR6AndhMz035hCMcY2PkbLcjIPqTV649/U+ioLzvnxa3bs53h/1GPEtpMLm9H6nJCvHYAE66kfEE12jx2CnTiBQGAabOPWL5nW4SzPFF5Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778246102; c=relaxed/simple; bh=GxfWeD5cXX4Ldsr11sclOUbqfKrbUoAmsnxolEiPIcg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=m9/4W2un/Mqir1I+trEUVQVBOGNEEjRsQ93vkQ2ekUYlpO9ID5s+w76Wi+/1mIk5jetfT/mKYfDmySxD+2BsYNtc6rv8MnnBAS4YVbtYCxb7cv7GiJ3LHozNE06cG8z4d6ymCJ6oaSXEpJts3TSuWo409VUc7CWtmqxh8KKdqGc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AGiIwM7A; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AGiIwM7A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20DA3C2BCB0; Fri, 8 May 2026 13:15:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778246102; bh=GxfWeD5cXX4Ldsr11sclOUbqfKrbUoAmsnxolEiPIcg=; h=From:To:Cc:Subject:Date:Reply-To:From; b=AGiIwM7AE3DexsvkZEQkKVQ1/rqwg5m4l8LBqQDM5depa+pig1PmlxixjuhiwU9Lp TNv1FTPPm0SkS7TLBxP8qXAercNIghogfreV7BaGjTZwfueqYQj72tvHzxMUkjtRsA BaMLXt8LJHcowg4vZQn6ZW7DtzYBLDqqCLzXwgcE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43286: mm/hugetlb: restore failed global reservations to subpool Date: Fri, 8 May 2026 15:11:51 +0200 Message-ID: <2026050851-CVE-2026-43286-5df4@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4269; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=kgpXp2NtekpmgAH+d4casxMnFl4WeMFLPzINH2QD94s=; b=owGbwMvMwCRo6H6F97bub03G02pJDJl/H4pL5Exo04g1aJ10jmN2VXlHJdc5r7zJ2S4BZw3fp /ZUJEV3xLIwCDIxyIopsnzZxnN0f8UhRS9D29Mwc1iZQIYwcHEKwETqshjmuzG2tAq+2VdkYr9b P59t6+eMX30SDAum7CrrKz6n+uPMgqC9N5acTs/SvMQHAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") fixed an underflow error for hstate->resv_huge_pages caused by incorrectly attributing globally requested pages to the subpool's reservation. Unfortunately, this fix also introduced the opposite problem, which would leave spool->used_hpages elevated if the globally requested pages could not be acquired. This is because while a subpool's reserve pages only accounts for what is requested and allocated from the subpool, its "used" counter keeps track of what is consumed in total, both from the subpool and globally. Thus, we need to adjust spool->used_hpages in the other direction, and make sure that globally requested pages are uncharged from the subpool's used counter. Each failed allocation attempt increments the used_hpages counter by how many pages were requested from the global pool. Ultimately, this renders the subpool unusable, as used_hpages approaches the max limit. The issue can be reproduced as follows: 1. Allocate 4 hugetlb pages 2. Create a hugetlb mount with max=4, min=2 3. Consume 2 pages globally 4. Request 3 pages from the subpool (2 from subpool + 1 from global) 4.1 hugepage_subpool_get_pages(spool, 3) succeeds. used_hpages += 3 4.2 hugetlb_acct_memory(h, 1) fails: no global pages left used_hpages -= 2 5. Subpool now has used_hpages = 1, despite not being able to successfully allocate any hugepages. It believes it can now only allocate 3 more hugepages, not 4. With each failed allocation attempt incrementing the used counter, the subpool eventually reaches a point where its used counter equals its max counter. At that point, any future allocations that try to allocate hugeTLB pages from the subpool will fail, despite the subpool not having any of its hugeTLB pages consumed by any user. Once this happens, there is no way to make the subpool usable again, since there is no way to decrement the used counter as no process is really consuming the hugeTLB pages. The underflow issue that the original commit fixes still remains fixed as well. Without this fix, used_hpages would keep on leaking if hugetlb_acct_memory() fails. The Linux kernel CVE team has assigned CVE-2026-43286 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit a833a693a490ecff8ba377654c6d4d333718b6b1 and fixed in 6.18.16 with commit 5eac1322a7b14b8cd05ec896618278b90fba7f39 Issue introduced in 6.15 with commit a833a693a490ecff8ba377654c6d4d333718b6b1 and fixed in 6.19.6 with commit f055897c975d079a90af873c791ab58cf0f6f2a5 Issue introduced in 6.15 with commit a833a693a490ecff8ba377654c6d4d333718b6b1 and fixed in 7.0 with commit 1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5 Issue introduced in 6.14.8 with commit adb5c2e55524e3a96b02c3904b0bb6d5a5404d21 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43286 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: mm/hugetlb.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5eac1322a7b14b8cd05ec896618278b90fba7f39 https://git.kernel.org/stable/c/f055897c975d079a90af873c791ab58cf0f6f2a5 https://git.kernel.org/stable/c/1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5