CVE-2026-93230

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

Gigantic bootmem HugeTLB pages are currently initialized from

hugetlb_init(), but page_alloc_init_late() runs earlier and walks

pageblocks to determine zone contiguity.

If a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can

observe still-uninitialized struct pages through

__pageblock_pfn_to_page(). This may not trigger an immediate failure, but

it can make set_zone_contiguous() compute the wrong zone contiguity state.

If extra poisoned-page checks are added in this path, such as

PF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot

panic.

Initialize gigantic bootmem HugeTLB struct pages from

page_alloc_init_late(), before zone contiguity is evaluated, so later page

allocator setup only sees valid struct page state. This also makes the

initialization order more natural, as struct pages should be initialized

be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References