Executive brief
A flaw in the Linux kernel's memory allocation subsystem allows an unprivileged user to crash the system by requesting gigantic hugepage allocations with specific memory policies on multi-NUMA systems. This causes a kernel panic (null pointer dereference) when the system attempts to allocate memory, resulting in service unavailability without requiring any special privileges or system compromise.
Technical details
The vulnerability is a null pointer dereference in hugetlb_cma_alloc_frozen_folio() occurring when a NULL nodemask is passed through the memory allocation path for gigantic hugetlb pages. The function dereferences the nodemask pointer in node_isset() and for_each_node_mask() calls without first checking if the pointer is NULL. An unprivileged user can trigger this via mmap() with MAP_HUGETLB and MAP_HUGE_1GB flags followed by mbind() with MPOL_PREFERRED_MANY on a system with CMA configured only on a subset of NUMA nodes. The fix involves checking for NULL nodemask and defaulting to cpuset_current_mems_allowed within a cpuset seqcount retry loop to safely handle concurrent cpuset changes. No exploit-in-the-wild activity is known; this is a kernel bug requiring unprivileged local access to trigger.
Affected products
- Linux Linux kernel affected versions unspecified in advisory
Timeline
- 2026-09-16: disclosed