FKIE_CVE-2026-89966

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-10-19 09:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to alloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes. If order is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL nodemask down to hugetlb_cma_alloc_frozen_folio() via alloc_gigantic_frozen_folio(). Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted allocation on hugetlb_cma[nid] without verifying if nid is included in the caller's nodemask. Adding a node_isset(nid, *nodemask) check ensures the initial preferred node allocation honors the memory policy / nodemask. However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask), leading to a null pointer dereference kernel panic when nodemask is NULL. Fix this by checking if nodemask is NULL in hugetlb_cma_alloc_frozen_folio() and defaulting it to cpuset_current_mems_allowed. Enclose the allocation attempts within the cpuset seqcount retry loop so that if the cpuset changes concurrently during allocation, the attempts are retried using the updated nodemask. This ensures that the initial node check and fallback loop safely honor the task's cpuset without violating cpuset constraints or causing NULL pointer dereferences or unexpected allocation failures. From a userspace perspective, this bug allows an unprivileged user to crash the kernel (trigger a panic) by requesting a gigantic hugepage allocation with MPOL_PREFERRED_MANY on a system where CMA is only configured on a subset of NUMA nodes. This can be reproduced by booting a VM with two NUMA nodes, restricting CMA to Node 1 (e.g., hugetlb_cma=1:1G default_hugepagesz=1G hugepagesz=1G hugepages=0), and running a program that allocates a 1GB hugepage area without reserving, restricts allocation to Node 0 using mbind() with MPOL_PREFERRED_MANY, and triggers a page fault: void *ptr = mmap(NULL, 1UL << 30, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB | MAP_HUGE_1GB | MAP_NORESERVE, -1, 0); unsigned long nodemask = 1; /* Node 0 */ mbind(ptr, 1UL << 30, MPOL_PREFERRED_MANY, &nodemask, sizeof(nodemask) * 8, 0); memset(ptr, 0, 1UL << 30); /* Trigger fault */ This results in a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:hugetlb_cma_alloc_frozen_folio+0x75/0x120 Call Trace: <TASK> only_alloc_fresh_hugetlb_folio.isra.0+0x2c/0x160 alloc_surplus_hugetlb_folio+0x6d/0x100 alloc_hugetlb_folio+0x3c5/0x660 hugetlb_no_page+0x3d9/0x650
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/10f616ef06c5bd2d656a0eebaf73f9b09d150c24
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7b8a8ae4dd176a232e973017d2aa3c536a7275e2
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb_cma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10f616ef06c5bd2d656a0eebaf73f9b09d150c24",
              "status": "affected",
              "version": "eb02f14c4a2bf4c242d91c4a5d7fb57c3c0ad1b1",
              "versionType": "git"
            },
            {
              "lessThan": "7b8a8ae4dd176a232e973017d2aa3c536a7275e2",
              "status": "affected",
              "version": "eb02f14c4a2bf4c242d91c4a5d7fb57c3c0ad1b1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb_cma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio\n\nalloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to\nalloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes.  If\norder is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL\nnodemask down to hugetlb_cma_alloc_frozen_folio() via\nalloc_gigantic_frozen_folio().\n\nAdditionally, hugetlb_cma_alloc_frozen_folio() previously attempted\nallocation on hugetlb_cma[nid] without verifying if nid is included in the\ncaller\u0027s nodemask.  Adding a node_isset(nid, *nodemask) check ensures the\ninitial preferred node allocation honors the memory policy / nodemask.\n\nHowever, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in\nnode_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask),\nleading to a null pointer dereference kernel panic when nodemask is NULL.\n\nFix this by checking if nodemask is NULL in\nhugetlb_cma_alloc_frozen_folio() and defaulting it to\ncpuset_current_mems_allowed.  Enclose the allocation attempts within the\ncpuset seqcount retry loop so that if the cpuset changes concurrently\nduring allocation, the attempts are retried using the updated nodemask. \nThis ensures that the initial node check and fallback loop safely honor\nthe task\u0027s cpuset without violating cpuset constraints or causing NULL\npointer dereferences or unexpected allocation failures.\n\nFrom a userspace perspective, this bug allows an unprivileged user to\ncrash the kernel (trigger a panic) by requesting a gigantic hugepage\nallocation with MPOL_PREFERRED_MANY on a system where CMA is only\nconfigured on a subset of NUMA nodes.\n\nThis can be reproduced by booting a VM with two NUMA nodes, restricting\nCMA to Node 1 (e.g., hugetlb_cma=1:1G default_hugepagesz=1G hugepagesz=1G\nhugepages=0), and running a program that allocates a 1GB hugepage area\nwithout reserving, restricts allocation to Node 0 using mbind() with\nMPOL_PREFERRED_MANY, and triggers a page fault:\n\n  void *ptr = mmap(NULL, 1UL \u003c\u003c 30, PROT_READ | PROT_WRITE,\n                   MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB |\n                   MAP_HUGE_1GB | MAP_NORESERVE, -1, 0);\n  unsigned long nodemask = 1; /* Node 0 */\n  mbind(ptr, 1UL \u003c\u003c 30, MPOL_PREFERRED_MANY, \u0026nodemask,\n        sizeof(nodemask) * 8, 0);\n  memset(ptr, 0, 1UL \u003c\u003c 30); /* Trigger fault */\n\nThis results in a NULL pointer dereference:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  RIP: 0010:hugetlb_cma_alloc_frozen_folio+0x75/0x120\n  Call Trace:\n   \u003cTASK\u003e\n   only_alloc_fresh_hugetlb_folio.isra.0+0x2c/0x160\n   alloc_surplus_hugetlb_folio+0x6d/0x100\n   alloc_hugetlb_folio+0x3c5/0x660\n   hugetlb_no_page+0x3d9/0x650"
    }
  ],
  "id": "CVE-2026-89966",
  "lastModified": "2026-10-19T09:18:43.030",
  "metrics": {},
  "published": "2026-09-16T11:17:07.160",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/10f616ef06c5bd2d656a0eebaf73f9b09d150c24"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7b8a8ae4dd176a232e973017d2aa3c536a7275e2"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.