Allocate_file_region_entries() tops up the reservation region cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, causing the resv->lock to be dropped during the allocation. The splice that moves the allocated entries into the cache uses list_splice(), which does not re‑initialise the source list head. Consequently, the stale head can be reused in a subsequent iteration of the cache‑top‑up loop, corrupting the doubly‑linked list in resv->region_cache. This corruption triggers a kernel BUG, leading to a system panic. The bug manifests when multiple processes map a hugetlbfs file via MAP_SHARED and concurrently modify the reservation map, such as during KVM, QEMU, and SPDK/DPDK interactions. A real host crash was observed in a dense KVM environment. This is a form of improper list manipulation (CWE-367) that can lead to use‑after‑free and memory corruption.

All Linux kernel releases before the commit that replaces list_splice() with list_splice_init() in the mm/hugetlb subsystem. The flaw exists whenever hugetlbfs files are mounted and accessed with MAP_SHARED by multiple services sharing the same reservation map.

The CVSS score is 7.8 and the EPSS score is <1%, indicating a high severity and low likelihood of exploitation. The vulnerability caused a production host crash in a dense KVM environment, demonstrating significant impact. The likely attack vector requires a local malicious process with sufficient privileges to perform mmap on a hugetlbfs file; this inference is derived from the need for concurrent access to a shared reservation map, which is not explicitly stated in the description. The absence of a KEV listing suggests no publicly known exploits yet, but the crash potential keeps the severity high.