---
id: CVE-2026-93232
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages

  Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4.

  This series is split out f…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages

  Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4.

  This series is split out f…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 622026e87c4019e609010811757e31193cc23847 <
    2ddf429e25cf8415d9c308f07e64012026bd4d77
  - >-
    Linux >= 622026e87c4019e609010811757e31193cc23847 <
    c0caeceb0c3899dc42844d3979093b27d1434108
  - Linux 7.1
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:18.767'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93232'
references:
  - url: 'https://git.kernel.org/stable/c/2ddf429e25cf8415d9c308f07e64012026bd4d77'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c0caeceb0c3899dc42844d3979093b27d1434108'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T15:45:56.662Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages

Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4.

This series is split out from the earlier larger series "mm: Generalize
HVO for HugeTLB and device DAX" [1].  It collects the first 19 patches of
that series as a standalone set of fixes and preparatory cleanups around
bootmem HugeTLB handling, sparse initialization ordering, and related
vmemmap setup.

The first patches fix a few bugs found while reviewing the existing code,
including incorrect bootmem HVO handling, wrong vmemmap registration
arguments, a powerpc compound-vmemmap tracking bug, and too-late
initialization of gigantic bootmem HugeTLB struct pages.

The rest of the series reorders early memory initialization so the
relevant zone state is available before sparse and HugeTLB boot-time setup
runs, then simplifies the remaining bootmem gigantic hugepage allocation
path and removes code made obsolete by that rework.

At a high level:
  - patches [1-4] fix boot-time and arch-specific bugs
  - patches [5-12] reorder and simplify sparse/mm/hugetlb early init
  - patches [13-19] refactor bootmem gigantic hugepage allocation and
    remove obsolete helpers and state


This patch (of 19):

Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched
HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].

Those shared tail pages were initialized in hugetlb_vmemmap_init(), but
bootmem HugeTLB folios are prepared earlier from
gather_bootmem_prealloc().  With hugetlb_free_vmemmap=on,
prep_and_add_bootmem_folios() can access pageblock flags on bootmem
HugeTLB pages whose mirrored tail struct pages already point to the shared
tail page.  On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then
dereferences the still-uninitialized shared tail page and can panic during
boot.

Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before
bootmem HugeTLB folios are processed, and drop the later initialization
from hugetlb_vmemmap_init().

This bug only affects CONFIG_DEBUG_VM kernels, where the relevant
assertion is evaluated.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.