CVE-2026-74518

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix list corruption in allocate_file_region_entries()

allocate_file_region_entries() tops up resv->region_cache with freshly

allocated file_region descriptors. The allocation uses GFP_KERNEL, so

resv->lock is dropped around it: the new entries are gathered on a

stack-local list head, allocated_regions, and spliced into

resv->region_cache once the lock is re-acquired.

The splice used list_splice(), which moves the entries but does not

re-initialize the source head, so allocated_regions is left pointing at an

entry that now lives on resv->region_cache. The top-up runs in a while

loop that re-checks the cache deficit after re-acquiring the lock. For a

shared mapping the resv_map is shared by every mapper of the hugetlbfs

inode, so a concurrent region_chg()/region_add()/region_del() on the same

resv_map can consume cache entries during the unlocked window and force a

second iteration. That iteration call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References