CVE-2026-89966

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to

alloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes. If

order is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL

nodemask down to hugetlb_cma_alloc_frozen_folio() via

alloc_gigantic_frozen_folio().

Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted

allocation on hugetlb_cma[nid] without verifying if nid is included in the

caller's nodemask. Adding a node_isset(nid, *nodemask) check ensures the

initial preferred node allocation honors the memory policy / nodemask.

However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in

node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask),

leading to a null pointer dereference kernel panic when nodemask is NULL.

Fix this by checking if nodemask is NULL in

hugetlb_cm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References