CVE-2026-72213

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A mismatch occurs in the hugetlb cgroup charge and uncharge process. In the alloc hugetlb folio() function, a single h cg pointer is used for both reserved (rsvd) and non-reserved hugetlb cgroup charges. When map chg is set, hugetlb cgroup charge cgroup rsvd() stores the charged cgroup in h cg, but the subsequent hugetlb cgroup charge cgroup() overwrites h cg with the non-reserved cgroup pointer. Consequently, hugetlb cgroup commit charge rsvd() stores the incorrect non-reserved cgroup pointer into the folio's reserved slot. When the folio is later freed, free huge folio() calls both hugetlb cgroup uncharge folio() and hugetlb cgroup uncharge folio rsvd(). The reserved uncharge process reads the wrong cgroup and decrements a counter that was never charged, leading to a page counter underflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.