CVE-2026-72213

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd

and non-rsvd hugetlb cgroup charges. When map_chg is set,

hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but

the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg

with the non-rsvd cgroup pointer.

As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong

(non-rsvd) cgroup pointer into the folio's rsvd slot.

When the folio is later freed, free_huge_folio() unconditionally calls

both hugetlb_cgroup_uncharge_folio() and

hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the

wrong cgroup from the folio and decrements a counter that was never

charged for that cgroup, causing a page_counter underflow:

page_counter underflow: -512 nr_pages=512

WARNING: mm/page_counter.c:61 at page_counter_cancel

Fix this by introduc

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References