CVE-2026-98373

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: preserve mremap address delta when skipping page tables

move_hugetlb_page_tables() optimizes mremap() by advancing to the last

entry in the page table when the source page table does not exist, either

initially or after unsharing a PMD table. The common loop increment then

steps to the first entry in the next page table.

However, the code advances both the source and destination addresses to

the last entries in their respective page tables, which is wrong. The

destination address must be advanced only by the same amount as the source

address.

If the source and destination offsets within their page tables differ, the

destination address can be advanced too far, causing follow-up issues.

Fix this by advancing the destination address by the source advance

distance.

With a reproducer, we were able to trigger a kernel panic on x86-64. With

this fix in place, we can no longer reproduce the issue.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References