---
id: CVE-2026-72213
title: 'mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

  In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd
  and non-rsvd hugetlb cgroup char…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa <
    5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd
  - >-
    Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa <
    1697d253f51cf5e3825a3423ff49e128a3502ab2
  - >-
    Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa <
    b785f2bd9496facedc0a031be09cddcd1d3c84d3
  - >-
    Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa <
    15807d0ddde37407af72859426b654f3d1972b00
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T18:43:53.609919Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:01.945Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72213'
references:
  - url: 'https://git.kernel.org/stable/c/5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd'
  - url: 'https://git.kernel.org/stable/c/1697d253f51cf5e3825a3423ff49e128a3502ab2'
  - url: 'https://git.kernel.org/stable/c/b785f2bd9496facedc0a031be09cddcd1d3c84d3'
  - url: 'https://git.kernel.org/stable/c/15807d0ddde37407af72859426b654f3d1972b00'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05222
ingestedAt: '2026-10-16T19:46:24.424Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd
and non-rsvd hugetlb cgroup charges.  When map_chg is set,
hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but
the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg
with the non-rsvd cgroup pointer.

As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
(non-rsvd) cgroup pointer into the folio's rsvd slot.

When the folio is later freed, free_huge_folio() unconditionally calls
both hugetlb_cgroup_uncharge_folio() and
hugetlb_cgroup_uncharge_folio_rsvd().  The rsvd uncharge reads back the
wrong cgroup from the folio and decrements a counter that was never
charged for that cgroup, causing a page_counter underflow:

  page_counter underflow: -512 nr_pages=512
  WARNING: mm/page_counter.c:61 at page_counter_cancel

Fix this by introducing a separate h_cg_rsvd pointer exclusively for the
rsvd charge path, keeping the rsvd and non-rsvd charges fully independent
through their charge, commit, and error uncharge paths.

## Affected

- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd`
- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 1697d253f51cf5e3825a3423ff49e128a3502ab2`
- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < b785f2bd9496facedc0a031be09cddcd1d3c84d3`
- `Linux >= 08cf9faf7558020aed6a0da5810b824b07139dfa < 15807d0ddde37407af72859426b654f3d1972b00`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.