The Linux kernel commit that attempted to use mmap_prepare for hugetlbfs mismanaged the allocation of VMA lock structures. If a memory allocation fails after mmap_prepare is invoked, the lock associated with the hugeTLB virtual memory area may leak, creating an uncontrolled increase in kernel-held locks. This lock leak can exhaust lock resources, degrading system stability or enabling a denial‑of‑service attack. The weakness is a failure to release a critical kernel resource, matching CWE‑400 and CWE‑772.

Linux kernel versions that incorporated the problematic commit before its revert are affected. The vulnerability resides in the hugetlbfs memory manager within the kernel’s virtual memory subsystem. Any distribution kernel that included this commit prior to the revert is at risk, as the vendor product list is generic Linux kernel.

The CVSS score of 5.5 indicates moderate severity, and no EPSS data is available. The vulnerability is not listed in CISA KEV. The issue arises during a failed mmap operation; therefore, the most likely attack vector is local or privileged, where an attacker can induce mmap failures in hugetlbfs to exhaust lock resources, resulting in a denial of service. Because the commit has been reverted, the risk persists only until a system is updated to a patched kernel that includes the revert.