Executive brief
The Linux kernel's hugetlbfs filesystem (used for managing large memory pages) fails to properly release reserved memory when filesystem mounting fails. This causes memory reservations to remain locked indefinitely, gradually consuming system resources and potentially leading to denial of service if an attacker can repeatedly trigger failed mount attempts.
Technical details
The vulnerability is a resource leak (CWE-404) in hugetlbfs_fill_super(), which is called during filesystem mounting. When size or min_size mount options are specified, the function allocates a hugepage subpool and reserves huge pages. If root dentry creation fails after subpool creation, the error path uses kfree() to free the subpool, bypassing the proper cleanup function hugepage_put_subpool(). This leaves min_size reservations charged to the system indefinitely. The fix replaces the direct kfree() with a conditional call to hugepage_put_subpool() to ensure proper deallocation matching the normal put_super path. Local access is required to mount filesystems.
Affected products
- Linux Linux kernel multiple versions with hugetlbfs support
Timeline
- 2026-09-17: disclosed
- 2026-07-20: patched: Fix committed upstream; backported to stable kernels