{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89593", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.730Z", "datePublished": "2026-09-11T19:44:56.557Z", "dateUpdated": "2026-09-11T19:44:56.557Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:44:56.557Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlb: only adjust reservation during unmapping if mapcount is 0\n\nSince df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In\nthe case of folio mapped in both a parent and a child, if the parent\nunmaps the range first, the reservation adjustment will result in an\nunderflow of the reserved count. Once the child unmaps the range, the\ncount is restored. Change __unmap_hugepage_range() to check the mapcount\nbefore adjusting the reservation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/hugetlb.c"], "versions": [{"version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3", "lessThan": "a3c65af20cceb7f997847727636b4017326f845d", "status": "affected", "versionType": "git"}, {"version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3", "lessThan": "0f001491e5a2ec69aa9d5dd6b799e5742245f9ea", "status": "affected", "versionType": "git"}, {"version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3", "lessThan": "5120b1e048d48596ffaec1a8412012a91adba73b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/hugetlb.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a3c65af20cceb7f997847727636b4017326f845d"}, {"url": "https://git.kernel.org/stable/c/0f001491e5a2ec69aa9d5dd6b799e5742245f9ea"}, {"url": "https://git.kernel.org/stable/c/5120b1e048d48596ffaec1a8412012a91adba73b"}], "title": "hugetlb: only adjust reservation during unmapping if mapcount is 0", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/hugetlb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a3c65af20cceb7f997847727636b4017326f845d", "status": "affected", "version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3", "versionType": "git"}, {"lessThan": "0f001491e5a2ec69aa9d5dd6b799e5742245f9ea", "status": "affected", "version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3", "versionType": "git"}, {"lessThan": "5120b1e048d48596ffaec1a8412012a91adba73b", "status": "affected", "version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/hugetlb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlb: only adjust reservation during unmapping if mapcount is 0\n\nSince df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In\nthe case of folio mapped in both a parent and a child, if the parent\nunmaps the range first, the reservation adjustment will result in an\nunderflow of the reserved count. Once the child unmaps the range, the\ncount is restored. Change __unmap_hugepage_range() to check the mapcount\nbefore adjusting the reservation."}], "id": "CVE-2026-89593", "lastModified": "2026-09-11T20:19:43.920", "metrics": {}, "published": "2026-09-11T20:19:43.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f001491e5a2ec69aa9d5dd6b799e5742245f9ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5120b1e048d48596ffaec1a8412012a91adba73b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3c65af20cceb7f997847727636b4017326f845d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel hugetlb: Incorrect huge page reservation can lead to system instability", "id": "2532027", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532027"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["A flaw was found in the Linux kernel's huge page (hugetlb) subsystem. This vulnerability occurs when a huge page of memory is shared between a parent and a child process. If the parent process unmaps the huge page before the child, the system can incorrectly reduce the count of reserved huge pages. This error can lead to system instability or a denial of service, making the system unresponsive or unavailable."], "name": "CVE-2026-89593", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:44:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89593\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89593\nhttps://git.kernel.org/stable/c/0f001491e5a2ec69aa9d5dd6b799e5742245f9ea\nhttps://git.kernel.org/stable/c/5120b1e048d48596ffaec1a8412012a91adba73b\nhttps://git.kernel.org/stable/c/a3c65af20cceb7f997847727636b4017326f845d"], "threat_severity": "Moderate"}

{}