SB20260509103 - Integer underflow in Linux kernel mm

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-43286)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in hugetlb subpool reservation accounting when handling failed hugeTLB page allocations from the global pool. A local user can trigger failed allocation attempts to cause a denial of service.

Repeated failed allocation attempts can permanently exhaust the subpool's used counter, making the subpool unusable even though no hugeTLB pages are actually consumed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5
• https://git.kernel.org/stable/c/5eac1322a7b14b8cd05ec896618278b90fba7f39
• https://git.kernel.org/stable/c/f055897c975d079a90af873c791ab58cf0f6f2a5