In the Linux kernel, the mm/hugetlb subsystem improperly adjusts the subpool used_hpages counter when a global page request fails. Instead of rolling back the counter, the kernel leaves the subpool’s usage counter elevated. Each subsequent failed allocation increments this counter further, eventually reaching the subpool’s maximum limit. At that point the subpool reports that no more hugepages are available, even though no actual hugepages have been consumed. This flaw does not grant any privilege escalation; it merely depletes a kernel resource and can prevent legitimate processes from allocating hugepages. The bug is rooted in incorrect bookkeeping.

All Linux kernel implementations that include the hugetlb subpool reservation logic are affected. No specific version ranges are provided in the advisory, so any kernel version prior to the commit that fully corrects the counter adjustment logic is susceptible.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is unknown. The flaw can be leveraged by a local user with the ability to trigger repeated hugepage allocation failures—typically requiring sufficient privileges to perform memory allocations that exhaust the reserved pool. Based on the description, it is inferred that the attack requires local execution and repeated attempts; it does not provide remote code execution or privilege escalation. Because the attack surface is local and demands repeated allocations, opportunistic exploitation is considered moderate. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been widely exploited yet, but systems that heavily rely on hugepages are at significant risk if the kernel is unpatched.