{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-72213",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-72213"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch\n\nIn alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd\nand non-rsvd hugetlb cgroup charges.  When map_chg is set,\nhugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but\nthe immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg\nwith the non-rsvd cgroup pointer.\n\nAs a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong\n(non-rsvd) cgroup pointer into the folio's rsvd slot.\n\nWhen the folio is later freed, free_huge_folio() unconditionally calls\nboth hugetlb_cgroup_uncharge_folio() and\nhugetlb_cgroup_uncharge_folio_rsvd().  The rsvd uncharge reads back the\nwrong cgroup from the folio and decrements a counter that was never\ncharged for that cgroup, causing a page_counter underflow:\n\n  page_counter underflow: -512 nr_pages=512\n  WARNING: mm/page_counter.c:61 at page_counter_cancel\n\nFix this by introducing a separate h_cg_rsvd pointer exclusively for the\nrsvd charge path, keeping the rsvd and non-rsvd charges fully independent\nthrough their charge, commit, and error uncharge paths.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72213"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5c32ae4a91fb5f4941328e0c1720a7fa4189c3bd"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1697d253f51cf5e3825a3423ff49e128a3502ab2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b785f2bd9496facedc0a031be09cddcd1d3c84d3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/15807d0ddde37407af72859426b654f3d1972b00"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:50:24Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is in alloc_hugetlb_folio()/free_huge_folio() and is reached only via local MM paths (mmap/munmap, hugetlb page faults, fallocate, memfd MFD_HUGETLB, MAP_HUGETLB) that syzbot triggered through hugetlbfs inode eviction, not via any network-facing kernel service.\nAC:L - An unprivileged attacker can reliably trigger the mismatch by creating hugetlbfs mappings without reservations (MAP_NORESERVE or fault-before-reserve), faulting in huge pages to run alloc_hugetlb_folio() with map_chg set, then closing/unmapping to free folios and hit the bad rsvd uncharge.\nPR:L - Triggering requires only an unprivileged local process that can use hugetlb memory (hugetlbfs/MAP_HUGETLB/memfd) under a hugetlb cgroup; no init-namespace root or special driver capabilities are needed, and cgroup hugetlb limits are controllable from user namespaces.\nUI:N - Exploitation is fully attacker-driven through normal syscalls (mmap, write/fault, close/unlink) and does not require any victim user action beyond the attacker operating on their own mappings.\nS:U - Impact is confined to kernel hugetlb/cgroup page_counter accounting within the same host kernel security domain; it does not cross VM, container runtime, or IOMMU boundaries.\nC:N - The flaw corrupts hugetlb cgroup reservation counters and emits a WARN on underflow; it does not read or disclose kernel memory, pointers, or other confidential data to the attacker.\nI:H - page_counter underflow forcibly resets hugetlb cgroup reservation usage to zero, corrupting kernel accounting so an attacker can bypass hugetlb.rsvd cgroup limits and consume hugepage resources beyond enforced quotas in multi-tenant/container deployments.\nA:H - free_huge_folio() unconditionally hits the bad rsvd uncharge and triggers a kernel WARNING/page_counter underflow during hugepage teardown; syzbot classified this as DoS and repeated alloc/free cycles can disrupt hugetlb availability for other workloads when limits are bypassed."
    }
  }
}