CVE-2026-90283

Summary

In the Linux kernel, the following vulnerability has been resolved:

hugetlbfs: release subpool on fill_super failure

hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size.

If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged.

Use hugepage_put_subpool() on the failure path, matching the normal put_super path.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < f2d6cea221d777fab3ba18f805ba4c17c90e0b8baffected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < 91c4f3a87862fd86594d5945512decbfa0b1d13daffected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < 04f0354a4abf6793aa5b3f32e2b019ab206f344daffected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < 5b7fc7a1ce2a5f2cd8ed80a883157c7108074e0baffected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < 1d8be4ee81e73fcc52e58f47842d9a2277cfeaaaaffected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < dfe848cadfde4179a0691da34f4bed36ff7185b5affected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < dc2bd517ac0bce4ec7498644bd16b6db502df8e2affected
LinuxLinux7ca02d0ae586fe7df59632966a64f3f1a756ef05 < 308ab73e97c87bd0e142b11758faab7f88d82854affected
LinuxLinux4.1affected
LinuxLinux0 < 4.1unaffected
LinuxLinux5.10.270 <= 5.10.*unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References