mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
CVE-2026-72213 · published 15 Aug 2026
How serious is it
- Severity: high, CVSS score 7.1 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-72213?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 08cf9faf7558020aed6a0da5810b824b07139dfa to < 043c509f2488033c68c46d2de2af082fcd568612, 08cf9faf7558020aed6a0da5810b824b07139dfa to < 5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd, 08cf9faf7558020aed6a0da5810b824b07139dfa to < 1697d253f51cf5e3825a3423ff49e128a3502ab2, 08cf9faf7558020aed6a0da5810b824b07139dfa to < b785f2bd9496facedc0a031be09cddcd1d3c84d3
- Linux Linux: 5.7
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd
and non-rsvd hugetlb cgroup charges. When map_chg is set,
hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but
the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg
with the non-rsvd cgroup pointer.
As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
(non-rsvd) cgroup pointer into the folio's rsvd slot.
When the folio is later freed, free_huge_folio() unconditionally calls
both hugetlb_cgroup_uncharge_folio() and
hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the
wrong cgroup from the folio and decrements a counter that was never
charged for that cgroup, causing a page_counter underflow:
page_counter underflow: -512 nr_pages=512
WARNING: mm/page_counter.c:61 at page_counter_cancel
Fix this by introducing a separate h_cg_rsvd pointer exclusively for the
rsvd charge path, keeping the rsvd and non-rsvd charges fully independent
through their charge, commit, and error uncharge paths.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/043c509f2488033c68c46d2de2af082fcd568612
- git.kernel.org/stable/c/5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd
- git.kernel.org/stable/c/1697d253f51cf5e3825a3423ff49e128a3502ab2
- git.kernel.org/stable/c/b785f2bd9496facedc0a031be09cddcd1d3c84d3
- git.kernel.org/stable/c/15807d0ddde37407af72859426b654f3d1972b00
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON