Cloudanix VulnDB

CVE-2026-90283

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain large-memory file systems could slowly leak reserved memory pages, making less memory available to programs until the system is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect error handling in hugetlbfs_fill_super leaves min_size hugepage reservations charged when root dentry creation fails, because the subpool is freed with kfree instead of hugepage_put_subpool.

Why it matters to the business

Systems using hugetlbfs mounts with min_size may experience gradual exhaustion of reserved huge pages, reducing available resources for applications that depend on them and potentially causing performance degradation or allocation failures over time.

How an attack unfolds

An attacker with local mount privileges crafts a hugetlbfs mount that specifies min_size, then triggers a failure during root dentry creation; the buggy error path leaks the reservation instead of returning it, accumulating charged pages across repeated attempts.

How to fix it

Apply the upstream fix that replaces the erroneous kfree with hugepage_put_subpool on the fill_super failure path; rebuild and deploy the corrected kernel. No configuration workaround exists.

How to confirm the fix worked

Confirm the presence of the corrected hugepage_put_subpool call in hugetlbfs_fill_super error handling within the running kernel source or binary; monitor /proc/meminfo HugePages_* counters during repeated mount-failure tests to verify reservations are released.

Typical attack path

  1. Obtain local access or container escape sufficient to perform mounts
  2. Issue a hugetlbfs mount command supplying both size and min_size options
  3. Force root dentry creation to fail after subpool allocation
  4. Repeat to accumulate leaked min_size reservations

How to detect it

Review kernel logs for hugetlbfs mount failures around the time of dentry creation errors; correlate with unexpected growth in reserved hugepage counters that do not decrease after unmount.

What your security team should do

  • Prioritize kernel update on any system exposing hugetlbfs to untrusted users or containers
  • Audit existing hugetlbfs mount scripts and containers for min_size usage
  • Add kernel version checks to vulnerability scanning pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size. If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged. Use hugepage_put_subpool() on the failure path, matching the normal put_super path.

Affected packages

Ecosystem Package Introduced Fixed