The Linux kernel hugetlb cgroup charge logic mistakenly reuses a single pointer for both reserved and non‑reserved charge paths, resulting in the commit routine storing the wrong cgroup reference in the reserved slot. When a folio is freed, the kernel attempts to uncharge that wrong reference, decrementing a counter that was never incremented and causing a page counter underflow. This corruption of kernel bookkeeping can lead to memory corruption or a denial‑of‑service condition.

All Linux kernel releases that lack the commit identified by the references identified by the references in the advisory are affected. The flaw applies to any system using the hugetlb cgroup subsystem before the patch from the commit referenced in the advisory. No specific kernel version was enumerated, so the vulnerability is relevant to all current kernel releases prior to those commits.

The vulnerability has a CVSS score of 7.1, indicating high severity. It has an EPSS score of < 1%, indicating a very low exploitation probability, and is not listed in the KEV catalog. Exploiting the flaw would require manipulating hugetlb cgroup allocations, implying that local or privileged access is necessary. No publicly available exploits are known, but an attacker with sufficient privileges could trigger the mismatch to cause a page counter underflow and crash the kernel or lead to untrusted memory exposure.