---
id: CVE-2026-98729
title: 'x86/mm: Don''t apply va_align to hugetlb mappings on AMD F15h'
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h


  get_align_mask() returns huge_page_mask_align() for hugetlbfs, but
  get_align_bits()

  adds va_align.bits reg…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0 <
    fe23680e6f1d52b8cc45d77bf7c54249508a81c7
  - >-
    Linux >= 1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0 <
    b46b2e2de47ca9449532b0a7110ed99f79061d6e
  - >-
    Linux >= 1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0 <
    d2457a7e2727dc747a61a50d65c2f259afce8c45
  - Linux 6.13
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:06.633Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98729'
references:
  - url: 'https://git.kernel.org/stable/c/fe23680e6f1d52b8cc45d77bf7c54249508a81c7'
  - url: 'https://git.kernel.org/stable/c/b46b2e2de47ca9449532b0a7110ed99f79061d6e'
  - url: 'https://git.kernel.org/stable/c/d2457a7e2727dc747a61a50d65c2f259afce8c45'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.506Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h

get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits()
adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge
page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at
teardown.

This can be triggered on Carrizo and FX-8370E, both hstates.

Pass the file to get_align_bits() and skip the randomisation for hugetlbfs.

  [ bp: Massage commit message. ]

## Affected

- `Linux >= 1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0 < fe23680e6f1d52b8cc45d77bf7c54249508a81c7`
- `Linux >= 1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0 < b46b2e2de47ca9449532b0a7110ed99f79061d6e`
- `Linux >= 1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0 < d2457a7e2727dc747a61a50d65c2f259afce8c45`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.