Junglewise Threat Intelligence

CVE-2026-53154: Linux kernel memory reservation leak in mm/hugetlb

CVE-2026-53154 · Severity: info · CVSS 0 · Published 2026-06-25

Technologies: Linux. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's memory management system could cause a system to incorrectly track reserved memory. This occurs when certain memory operations fail, leading to a 'leak' of reserved memory addresses. In practice, this can cause applications to crash unexpectedly with a 'SIGBUS' error when the system is under memory pressure, potentially disrupting operations or services running on the affected machine.

Technical details

A resource management vulnerability exists in mm/hugetlb.c where the kernel fails to restore VMA reservations during error paths in hugetlb folio copy operations. Specifically, when alloc_hugetlb_folio() consumes a reservation and a subsequent call to copy_user_large_folio() fails (e.g., due to -EHWPOISON), the per-VMA reservation map entry remains marked as consumed even though the folio is freed. This affects the UFFDIO_COPY resubmission path and the fork-time Copy-on-Write (CoW) path. An attacker or a failing process can leak these reservations, causing subsequent faults at the same address to fail under pool pressure. The fix involves adding restore_reserve_on_error() before folio_put() in the affected error paths.

Affected products

  • Linux Linux 6.4 to 6.9.5

Timeline

  • 2026-05-20: disclosed: Initial patch submission by David Carlier
  • 2026-05-28: patched: Patch committed to mainline kernel by Andrew Morton
  • 2026-06-25: advisory: CVE-2026-53154 published

References