CVE-2026-53154

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: restore reservation on error in hugetlb folio copy paths

Two sites in mm/hugetlb.c allocate a hugetlb folio via

alloc_hugetlb_folio() (consuming a VMA reservation) and then call

copy_user_large_folio(), which became int-returning in commit 1cb9dc4b475c

("mm: hwpoison: support recovery from HugePage copy-on-write faults") and

can now fail (e.g. -EHWPOISON on a hwpoisoned source page). On the

failure path, folio_put() restores the global hugetlb pool count through

free_huge_folio(), but the per-VMA reservation map entry is left marked

consumed:

- hugetlb_mfill_atomic_pte() resubmission path (UFFDIO_COPY)

- copy_hugetlb_page_range() fork-time CoW path when

hugetlb_try_dup_anon_rmap() fails (rare: pinned hugetlb anon

folio under fork)

User-visible effect: on UFFDIO_COPY into a private hugetlb VMA where the

resubmission copy fails, the reservation for that address is leaked from

the VMA's reser

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References