Description
In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h

get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits()
adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge
page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at
teardown.

This can be triggered on Carrizo and FX-8370E, both hstates.

Pass the file to get_align_bits() and skip the randomisation for hugetlbfs.

[ bp: Massage commit message. ]
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service via kernel crash
Action: Patch Now
AI Analysis

Impact

The Linux kernel memory management code incorrectly applies an alignment mask to hugetlbfs mappings on AMD F15h processors. By adding the generic va_align bits when a huge‑page memory mapping is requested, the resulting virtual address can fall outside the required huge‑page boundary. When the kernel later calls __unmap_hugepage_range() to tear the mapping down, the address check triggers a BUG_ON, causing the kernel to panic. The outcome is a system crash that results in a denial of service. This weakness is consistent with improper initialization or incorrect alignment handling (CWE‑665).

Affected Systems

The flaw affects the Linux kernel on machines that use AMD Carrizo or FX‑8370E CPUs (both with the F15h microarchitecture). Any user who can create or access hugetlbfs file mappings on such hardware may be able to trigger the bug. The affected code path resides in the x86/mm subsystem and applies to all kernel versions released before the patch commit referenced in the advisory.

Risk and Exploitability

No CVSS score is published and EPSS data is not available, but the vulnerability can be exploited locally by mapping hugetlbfs pages. Because it relies on a privileged kernel data structure, a non‑privileged user needs elevated rights or an exploit that can access huge pages; therefore the availability of the attack depends on user permissions. The bug is not listed in the CISA KEV catalog, indicating no widespread exploitation evidence. Nevertheless, the potential for a kernel panic means affected systems should be updated promptly, and users should avoid creating hugetlbfs mappings on the affected CPUs until a patched kernel is released.

Generated by OpenCVE AI on October 18, 2026 at 19:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the commit that fixes the alignment bug (see commit references in the advisory).
  • Avoid using hugetlbfs on machines with AMD Carrizo or FX‑8370E until the kernel is updated.
  • If a kernel upgrade is not immediately possible, eliminate or disable huge‑page memory mappings in affected workloads to prevent accidental crashes.

Generated by OpenCVE AI on October 18, 2026 at 19:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits() adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at teardown. This can be triggered on Carrizo and FX-8370E, both hstates. Pass the file to get_align_bits() and skip the randomisation for hugetlbfs. [ bp: Massage commit message. ]
Title x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:47:06.633Z

Reserved: 2026-09-25T10:25:14.366Z

Link: CVE-2026-98729

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:26.530

Modified: 2026-10-18T16:17:26.530

Link: CVE-2026-98729

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T19:15:14Z

Weaknesses