CVE-2026-89593 - Vulnerability Details

- hugetlb: only adjust reservation during unmapping if mapcount is 0

Description

In the Linux kernel, the following vulnerability has been resolved:

hugetlb: only adjust reservation during unmapping if mapcount is 0

Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In
the case of folio mapped in both a parent and a child, if the parent
unmaps the range first, the reservation adjustment will result in an
underflow of the reserved count. Once the child unmaps the range, the
count is restored. Change __unmap_hugepage_range() to check the mapcount
before adjusting the reservation.

Published: 2026-09-11

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s huge page unmapping routine incorrectly decrements a reservation counter without first verifying that the mapping is the last reference. When a page is mapped in a parent and child and the parent unmaps first, the counter underflows. This bug results in corrupted reservation bookkeeping, affecting the kernel’s memory accounting. The flaw is an integer underflow (CWE‑191).

Affected Systems

All Linux kernel releases prior to the patch commit are affected. The vulnerability exists in the generic Linux kernel and applies regardless of distribution or build variant.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium‑high severity. Exploitation requires a process that can map and unmap huge pages, a capability normally restricted to privileged users or to processes running with CAP_SYS_ADMIN. The EPSS score of less than 1% implies a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. the underflow.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`df7a6d1f64056aec572162c5d35ed9ff86ece6f3`	affected	< b0b1b9ca80b795ed2223e76dd787db7067121fb9
`df7a6d1f64056aec572162c5d35ed9ff86ece6f3`	affected	< a3c65af20cceb7f997847727636b4017326f845d
`df7a6d1f64056aec572162c5d35ed9ff86ece6f3`	affected	< 0f001491e5a2ec69aa9d5dd6b799e5742245f9ea
`df7a6d1f64056aec572162c5d35ed9ff86ece6f3`	affected	< 5120b1e048d48596ffaec1a8412012a91adba73b

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.110`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[df7a6d1f64056aec572162c5d35ed9ff86ece6f3,a3c65af20cceb7f997847727636b4017326f845d)`	affected	code_commit	—
`[df7a6d1f64056aec572162c5d35ed9ff86ece6f3,0f001491e5a2ec69aa9d5dd6b799e5742245f9ea)`	affected	code_commit	—
`[df7a6d1f64056aec572162c5d35ed9ff86ece6f3,5120b1e048d48596ffaec1a8412012a91adba73b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit fixing the reservation adjustment guard.
If using a custom kernel, backport the upstream patch to the current kernel version.
Reboot the system after installing the updated kernel to ensure the issue is resolved.

Generated by OpenCVE AI on September 15, 2026 at 21:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f001491e5a2ec69aa9d5dd6b799e5742245f9ea
https://git.kernel.org/stable/c/5120b1e048d48596ffaec1a8412012a91adba73b
https://git.kernel.org/stable/c/a3c65af20cceb7f997847727636b4017326f845d
https://git.kernel.org/stable/c/b0b1b9ca80b795ed2223e76dd787db7067121fb9
https://nvd.nist.gov/vuln/detail/CVE-2026-89593
https://www.cve.org/CVERecord?id=CVE-2026-89593

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b0b1b9ca80b795ed2223e76dd787db7067121fb9

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-191
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89593 https://www.cve.org/CVERecord?id=CVE-2026-89593
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, the reservation adjustment will result in an underflow of the reserved count. Once the child unmaps the range, the count is restored. Change __unmap_hugepage_range() to check the mapcount before adjusting the reservation.
Title		hugetlb: only adjust reservation during unmapping if mapcount is 0
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f001491e5a2ec69aa9d5dd6b799e5742245f9ea https://git.kernel.org/stable/c/5120b1e048d48596ffaec1a8412012a91adba73b https://git.kernel.org/stable/c/a3c65af20cceb7f997847727636b4017326f845d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:56.557Z

Updated: 2026-09-14T12:01:16.035Z

Reserved: 2026-09-11T19:38:34.730Z

Link: CVE-2026-89593

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:43.920

Modified: 2026-09-14T13:19:13.207

Link: CVE-2026-89593

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:56Z

Links: CVE-2026-89593 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:45:17Z

Weaknesses

CWE-191
Integer Underflow (Wrap or Wraparound)

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object