CVE-2026-90283

hugetlbfs: release subpool on fill_super failure

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

hugetlbfs: release subpool on fill_super failure

hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size
mount options are specified. hugepage_new_subpool() may also reserve huge
pages for min_size.

If root dentry creation fails after the subpool is created, the failure
path frees the subpool with kfree(). This bypasses hugepage_put_subpool()
and can leave min_size reservations charged.

Use hugepage_put_subpool() on the failure path, matching the normal
put_super path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< f2d6cea221d777fab3ba18f805ba4c17c90e0b8b
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< 91c4f3a87862fd86594d5945512decbfa0b1d13d
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< 04f0354a4abf6793aa5b3f32e2b019ab206f344d
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< 5b7fc7a1ce2a5f2cd8ed80a883157c7108074e0b
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< 1d8be4ee81e73fcc52e58f47842d9a2277cfeaaa
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< dfe848cadfde4179a0691da34f4bed36ff7185b5
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< dc2bd517ac0bce4ec7498644bd16b6db502df8e2
`7ca02d0ae586fe7df59632966a64f3f1a756ef05`	affected	< 308ab73e97c87bd0e142b11758faab7f88d82854

Linux

affected

Version	Status	Constraints
`4.1`	affected	—
`0`	unaffected	< 4.1
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,f2d6cea221d777fab3ba18f805ba4c17c90e0b8b)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,91c4f3a87862fd86594d5945512decbfa0b1d13d)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,5b7fc7a1ce2a5f2cd8ed80a883157c7108074e0b)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,04f0354a4abf6793aa5b3f32e2b019ab206f344d)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,1d8be4ee81e73fcc52e58f47842d9a2277cfeaaa)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,dfe848cadfde4179a0691da34f4bed36ff7185b5)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,dc2bd517ac0bce4ec7498644bd16b6db502df8e2)`	affected	code_commit	—
`[7ca02d0ae586fe7df59632966a64f3f1a756ef05,308ab73e97c87bd0e142b11758faab7f88d82854)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.1`	affected	generic	—
`[0,4.1)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.227% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/04f0354a4abf6793aa5b3f32e2b019ab206f344d
https://git.kernel.org/stable/c/1d8be4ee81e73fcc52e58f47842d9a2277cfeaaa
https://git.kernel.org/stable/c/308ab73e97c87bd0e142b11758faab7f88d82854
https://git.kernel.org/stable/c/5b7fc7a1ce2a5f2cd8ed80a883157c7108074e0b
https://git.kernel.org/stable/c/91c4f3a87862fd86594d5945512decbfa0b1d13d
https://git.kernel.org/stable/c/dc2bd517ac0bce4ec7498644bd16b6db502df8e2
https://git.kernel.org/stable/c/dfe848cadfde4179a0691da34f4bed36ff7185b5
https://git.kernel.org/stable/c/f2d6cea221d777fab3ba18f805ba4c17c90e0b8b

History

Sep 19, 2026 3:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-400

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size. If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged. Use hugepage_put_subpool() on the failure path, matching the normal put_super path.
Title		hugetlbfs: release subpool on fill_super failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/04f0354a4abf6793aa5b3f32e2b019ab206f344d https://git.kernel.org/stable/c/1d8be4ee81e73fcc52e58f47842d9a2277cfeaaa https://git.kernel.org/stable/c/308ab73e97c87bd0e142b11758faab7f88d82854 https://git.kernel.org/stable/c/5b7fc7a1ce2a5f2cd8ed80a883157c7108074e0b https://git.kernel.org/stable/c/91c4f3a87862fd86594d5945512decbfa0b1d13d https://git.kernel.org/stable/c/dc2bd517ac0bce4ec7498644bd16b6db502df8e2 https://git.kernel.org/stable/c/dfe848cadfde4179a0691da34f4bed36ff7185b5 https://git.kernel.org/stable/c/f2d6cea221d777fab3ba18f805ba4c17c90e0b8b