{"id":"CVE-2026-72213","title":"mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch\n\nIn alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd\nand non-rsvd hugetlb cgroup char…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd","Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 1697d253f51cf5e3825a3423ff49e128a3502ab2","Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < b785f2bd9496facedc0a031be09cddcd1d3c84d3","Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 15807d0ddde37407af72859426b654f3d1972b00","Linux 5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:43:53.609919Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:45:01.945Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72213","references":[{"url":"https://git.kernel.org/stable/c/5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd"},{"url":"https://git.kernel.org/stable/c/1697d253f51cf5e3825a3423ff49e128a3502ab2"},{"url":"https://git.kernel.org/stable/c/b785f2bd9496facedc0a031be09cddcd1d3c84d3"},{"url":"https://git.kernel.org/stable/c/15807d0ddde37407af72859426b654f3d1972b00"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05222,"ingestedAt":"2026-10-16T19:46:24.424Z","slug":"CVE-2026-72213","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch\n\nIn alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd\nand non-rsvd hugetlb cgroup charges.  When map_chg is set,\nhugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but\nthe immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg\nwith the non-rsvd cgroup pointer.\n\nAs a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong\n(non-rsvd) cgroup pointer into the folio's rsvd slot.\n\nWhen the folio is later freed, free_huge_folio() unconditionally calls\nboth hugetlb_cgroup_uncharge_folio() and\nhugetlb_cgroup_uncharge_folio_rsvd().  The rsvd uncharge reads back the\nwrong cgroup from the folio and decrements a counter that was never\ncharged for that cgroup, causing a page_counter underflow:\n\n  page_counter underflow: -512 nr_pages=512\n  WARNING: mm/page_counter.c:61 at page_counter_cancel\n\nFix this by introducing a separate h_cg_rsvd pointer exclusively for the\nrsvd charge path, keeping the rsvd and non-rsvd charges fully independent\nthrough their charge, commit, and error uncharge paths.\n\n## Affected\n\n- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd`\n- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 1697d253f51cf5e3825a3423ff49e128a3502ab2`\n- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < b785f2bd9496facedc0a031be09cddcd1d3c84d3`\n- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 15807d0ddde37407af72859426b654f3d1972b00`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}