CVE-2026-43286

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: restore failed global reservations to subpool

Commit a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")

fixed an underflow error for hstate->resv_huge_pages caused by incorrectly

attributing globally requested pages to the subpool's reservation.

Unfortunately, this fix also introduced the opposite problem, which would

leave spool->used_hpages elevated if the globally requested pages could

not be acquired. This is because while a subpool's reserve pages only

accounts for what is requested and allocated from the subpool, its "used"

counter keeps track of what is consumed in total, both from the subpool

and globally. Thus, we need to adjust spool->used_hpages in the other

direction, and make sure that globally requested pages are uncharged from

the subpool's used counter.

Each failed allocation attempt increments the used_hpages counter by how

many pages were requested from the global pool.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References