CVE-2026-74518 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix list corruption in allocate_file_region_entries()
allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired.
The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips:
list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330 ksys_mmap_pgoff+0x2a1/0x3e0 do_syscall_64+0xd7/0x420
Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack address into resv->region_cache, leading to later use-after-free.
This was observed as a real host panic on a dense KVM host where a QEMU guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one shared resv_map.
Use list_splice_init() so the source head is re-initialized empty after each splice, making the retry loop safe.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability resides in the linux kernel's huge page memory management subsystem specifically within the hugetlb (huge pages) implementation. The flaw manifests in the allocate_file_region_entries() function which manages the caching of file_region descriptors for huge page mappings. This function operates under a lock mechanism where it temporarily releases resv->lock during memory allocation operations that use GFP_KERNEL flag, allowing for concurrent access patterns that introduce race conditions.
The technical root cause involves improper list management during the allocation process where newly created file_region entries are initially placed on a stack-local list head called allocated_regions. When the function re-acquires the lock, it attempts to splice these entries into the persistent resv->region_cache using list_splice() operation. The problem occurs because list_splice() transfers the list elements but leaves the source list head in an inconsistent state, meaning allocated_regions still contains references to nodes that have been moved to resv->region_cache.
This inconsistency becomes particularly dangerous during the retry loop execution which occurs when the cache deficit is checked after re-acquiring the lock. For shared mappings where multiple processes access the same hugetlbfs inode through MAP_SHARED flag, concurrent operations like region_chg(), region_add(), and region_del() can modify the shared resv_map while the lock is temporarily released. These concurrent modifications force a second iteration of the top-up loop, causing list_add() operations to be performed on the stale allocated_regions head which now points to nodes that are already part of resv->region_cache.
The consequence of this flaw aligns with CWE-127 and CWE-129 categories related to buffer under-reads and improper access to memory regions, creating a classic use-after-free scenario. With CONFIG_DEBUG_LIST enabled, the kernel's list validation mechanism detects the corruption through __list_add_valid() checks which fail with explicit error messages showing incorrect pointer values and triggering kernel BUG conditions that result in system panics.
Without debugging features enabled, this corruption silently corrupts kernel memory structures by linking stack addresses into the persistent cache, leading to unpredictable behavior during subsequent memory operations. The vulnerability was observed in real-world scenarios involving dense virtualized environments where QEMU and SPDK/DPDK components both mapped the same hugetlbfs file with MAP_SHARED flag, generating concurrent region modification traffic on a single shared resv_map that triggered the race condition.
The mitigation strategy involves replacing list_splice() with list_splice_init() which properly re-initializes the source list head to an empty state after each splice operation. This ensures that subsequent iterations of the retry loop operate on clean, empty lists and prevents the corruption from occurring. This fix directly addresses the root cause by ensuring proper list state management during concurrent access patterns while maintaining the intended functionality of the memory allocation and caching mechanism.
The vulnerability demonstrates characteristics consistent with ATT&CK technique T1068 which involves privilege escalation through local exploitation of kernel vulnerabilities, specifically targeting memory management subsystems that handle shared resources. The attack surface is particularly relevant in virtualized environments where multiple processes or hypervisor components share memory mapping structures, making the system susceptible to race condition exploitation during concurrent access patterns.