CVE-2026-90283 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
hugetlbfs: release subpool on fill_super failure
hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size.
If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged.
Use hugepage_put_subpool() on the failure path, matching the normal put_super path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's hugetlbfs subsystem manages large memory pages to support applications requiring substantial contiguous virtual address spaces, such as high-performance databases or scientific computing workloads. A critical resource management flaw was identified within the filesystem initialization logic, specifically in the hugetlbfs_fill_super function which is responsible for setting up the superblock structure during mount operations. When a user specifies size or min_size parameters via mount options, the kernel attempts to allocate and initialize a hugepage subpool to manage these large page allocations efficiently. This process involves calling hugepage_new_subpool, which may also reserve specific numbers of huge pages corresponding to the configured minimum size constraints. These reservations are tracked as charges against the system's memory resources to ensure availability for subsequent allocation requests.
The vulnerability arises from an inconsistent error handling path during the initialization sequence. If the creation of the root directory entry fails after the subpool has already been successfully created, the existing cleanup code incorrectly attempts to release this resource by directly invoking kfree on the subpool structure pointer. This direct memory deallocation bypasses the specialized hugepage_put_subpool function, which is designed not only to free the structural data but also to properly uncharge and release any reserved pages associated with the min_size configuration. By skipping this critical cleanup routine, the kernel fails to revert the resource reservations that were established during the subpool creation phase.
This oversight results in a persistent memory leak within the hugetlbfs subsystem. The charged huge page reservations remain active even though the filesystem mount operation ultimately failed and no valid superblock exists for them. Over time, if an attacker or misconfigured application repeatedly triggers this failure condition by attempting to mount hugetlbfs with specific size parameters that lead to root dentry creation failures, these uncharged resources accumulate. This can gradually exhaust the system's available huge page pool, leading to a denial of service where legitimate applications are unable to allocate large memory pages despite having sufficient physical or swap space available in other forms. The impact is particularly severe on systems heavily reliant on hugetlbfs for performance-critical operations, as it degrades overall system stability and resource availability without necessarily causing an immediate kernel panic.
From a classification perspective, this issue aligns with CWE-401, which describes a missing release of memory after successful allocation, leading to resource exhaustion or leak. In the context of attack patterns, while not directly exploitable for remote code execution in most standard configurations due to the requirement for root privileges to mount filesystems with specific options, it represents a local denial-of-service vector that could be leveraged by privileged users to degrade system performance. The ATT&CK framework categorizes such resource exhaustion techniques under T1496, specifically relating to Resource Hijacking or Denial of Service through environmental exploitation.
The resolution involves modifying the error handling path in hugetlbfs_fill_super to ensure consistency with the normal cleanup procedures used during successful unmount operations. Instead of directly freeing the subpool structure using kfree, the corrected code now invokes hugepage_put_subpool. This function ensures that all associated reservations are properly released and charged back to the system's available pool, maintaining accurate accounting of hugetlbfs resources. To mitigate this vulnerability in environments where kernel updates may be delayed, administrators should monitor for repeated mount failures involving hugetlbfs with size parameters and ensure that any such failed attempts do not accumulate without manual intervention or service restarts. Regular auditing of memory usage patterns related to huge pages can also help detect early signs of resource leakage before they impact system stability.