CVE-2026-93232
📛 CVE Title
mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages
Description
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and device DAX" [1]. It collects the first 19 patches of that series as a standalone set of fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup. The first patches fix a few bugs found while reviewing the existing code, including incorrect bootmem HVO handling, wrong vmemmap registration arguments, a powerpc compound-vmemmap tracking bug, and too-late initialization of gigantic bootmem HugeTLB struct pages. The rest of the series reorders early memory initialization so the relevant zone state is available before sparse and HugeTLB boot-time setup runs, then simplifies the remaining bootmem gigantic hugepage allocation path and removes code made obsolete by that rework. At a high level: - patches [1-4] fix boot-time and arch-specific bugs - patches [5-12] reorder and simplify sparse/mm/hugetlb early init - patches [13-19] refactor bootmem gigantic hugepage allocation and remove obsolete helpers and state This patch (of 19): Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[]. Those shared tail pages were initialized in hugetlb_vmemmap_init(), but bootmem HugeTLB folios are prepared earlier from gather_bootmem_prealloc(). With hugetlb_free_vmemmap=on, prep_and_add_bootmem_folios() can access pageblock flags on bootmem HugeTLB pages whose mirrored tail struct pages already point to the shared tail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then dereferences the still-uninitialized shared tail page and can panic during boot. Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before bootmem HugeTLB folios are processed, and drop the later initialization from hugetlb_vmemmap_init(). This bug only affects CONFIG_DEBUG_VM kernels, where the relevant assertion is evaluated.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
- —
- Reserved
- 2026-09-17
- Published
- 2026-09-24 15:29 UTC
- Last updated
- 2026-09-24 15:29 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93232.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-24 16:17:18 UTC
- NVD last modified
- 2026-09-24 16:17:18 UTC
NVD / KEV / EPSS data refreshed 2026-09-25 04:32 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-86237 - Assigner
- Linux
- Published
- Sep 24, 2026, 3:29:22 PM
- Updated
- Sep 24, 2026, 3:29:22 PM
- EUVD base score
- 0.0 / 10
- EUVD-reported EPSS
- 0.0000
- Vendors
- Linux
- Products
-
Linux (7.1)Linux (622026e87c4019e609010811757e31193cc23847 <c0caeceb0c3899dc42844d3979093b27d1434108)Linux (patch: 7.2.4)Linux (622026e87c4019e609010811757e31193cc23847 <2ddf429e25cf8415d9c308f07e64012026bd4d77)Linux (patch: 7.3-rc1)Linux (patch: 0)
- Aliases
-
GHSA-rjqq-v75c-fv5f
ENISA description: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and device DAX" [1]. It collects the first 19 patches of that series as a standalone set of fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup. The first patches fix a few bugs found while reviewing the existing code, including incorrect bootmem HVO handling, wrong vmemmap registration arguments, a powerpc compound-vmemmap tracking bug, and too-late initialization of gigantic bootmem HugeTLB struct pages. The rest of the series reorders early memory initialization so the relevant zone state is available before sparse and HugeTLB boot-time setup runs, then simplifies the remaining bootmem gigantic hugepage allocation path and removes code made obsolete by that rework. At a high level: - patches [1-4] fix boot-time and arch-specific bugs - patches [5-12] reorder and simplify sparse/mm/hugetlb early init - patches [13-19] refactor bootmem gigantic hugepage allocation and remove obsolete helpers and state This patch (of 19): Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[]. Those shared tail pages were initialized in hugetlb_vmemmap_init(), but bootmem HugeTLB folios are prepared earlier from gather_bootmem_prealloc(). With hugetlb_free_vmemmap=on, prep_and_add_bootmem_folios() can access pageblock flags on bootmem HugeTLB pages whose mirrored tail struct pages already point to the shared tail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then dereferences the still-uninitialized shared tail page and can panic during boot. Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before bootmem HugeTLB folios are processed, and drop the later initialization from hugetlb_vmemmap_init(). This bug only affects CONFIG_DEBUG_VM kernels, where the relevant assertion is evaluated.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
622026e87c4019e609010811757e31193cc23847 (affected),
622026e87c4019e609010811757e31193cc23847 (affected)
|
— |
| Linux | Linux |
7.1 (affected),
0 (unaffected),
7.2.4 (unaffected),
7.3-rc1 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://git.kernel.org/stable/c/2ddf429e25cf8415d9c308f07e64012026bd4d77 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/c0caeceb0c3899dc42844d3979093b27d1434108 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remediations (10)
-
web:access.redhat.com
Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
2026-09-25 10:45 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-25 10:45 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-25 10:45 UTC -
web:support.apple.com
This document describes the security content of iOS 26.6 and iPadOS 26.6.
2026-09-25 10:45 UTC -
web:support.sap.com
On 14 th of July 2026 , SAP security patch day saw the release of 16 new security notes and 1 Github security advisory. There are 3 updates to previously released security notes.
2026-09-25 10:45 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-09-25 10:45 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-09-25 10:45 UTC -
web:www.openhands.dev
Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.
2026-09-25 10:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:45 UTC -
web:www.oracle.com
Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...
2026-09-25 10:45 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-93232.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c",
"mm/hugetlb_vmemmap.c",
"mm/sparse-vmemmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ddf429e25cf8415d9c308f07e64012026bd4d77",
"status": "affected",
"version": "622026e87c4019e609010811757e31193cc23847",
"versionType": "git"
},
{
"lessThan": "c0caeceb0c3899dc42844d3979093b27d1434108",
"status": "affected",
"version": "622026e87c4019e609010811757e31193cc23847",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c",
"mm/hugetlb_vmemmap.c",
"mm/sparse-vmemmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages\n\nPatch series \"mm: Refactor bootmem gigantic hugepage allocation\", v4.\n\nThis series is split out from the earlier larger series \"mm: Generalize\nHVO for HugeTLB and device DAX\" [1]. It collects the first 19 patches of\nthat series as a standalone set of fixes and preparatory cleanups around\nbootmem HugeTLB handling, sparse initialization ordering, and related\nvmemmap setup.\n\nThe first patches fix a few bugs found while reviewing the existing code,\nincluding incorrect bootmem HVO handling, wrong vmemmap registration\narguments, a powerpc compound-vmemmap tracking bug, and too-late\ninitialization of gigantic bootmem HugeTLB struct pages.\n\nThe rest of the series reorders early memory initialization so the\nrelevant zone state is available before sparse and HugeTLB boot-time setup\nruns, then simplifies the remaining bootmem gigantic hugepage allocation\npath and removes code made obsolete by that rework.\n\nAt a high level:\n - patches [1-4] fix boot-time and arch-specific bugs\n - patches [5-12] reorder and simplify sparse/mm/hugetlb early init\n - patches [13-19] refactor bootmem gigantic hugepage allocation and\n remove obsolete helpers and state\n\n\nThis patch (of 19):\n\nCommit 622026e87c40 (\"mm/hugetlb: remove fake head pages\") switched\nHVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].\n\nThose shared tail pages were initialized in hugetlb_vmemmap_init(), but\nbootmem HugeTLB folios are prepared earlier from\ngather_bootmem_prealloc(). With hugetlb_free_vmemmap=on,\nprep_and_add_bootmem_folios() can access pageblock flags on bootmem\nHugeTLB pages whose mirrored tail struct pages already point to the shared\ntail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then\ndereferences the still-uninitialized shared tail page and can panic during\nboot.\n\nInitialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before\nbootmem HugeTLB folios are processed, and drop the later initialization\nfrom hugetlb_vmemmap_init().\n\nThis bug only affects CONFIG_DEBUG_VM kernels, where the relevant\nassertion is evaluated."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:29:22.699Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ddf429e25cf8415d9c308f07e64012026bd4d77"
},
{
"url": "https://git.kernel.org/stable/c/c0caeceb0c3899dc42844d3979093b27d1434108"
}
],
"title": "mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93232",
"datePublished": "2026-09-24T15:29:22.699Z",
"dateReserved": "2026-09-17T16:02:15.095Z",
"dateUpdated": "2026-09-24T15:29:22.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}