Integer underflow in Linux kernel - CVE-2026-89593
Published: September 12, 2026
Vulnerability identifier: #VU149220
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89593
CWE-ID: CWE-191
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause incorrect huge-page reservation accounting.
The vulnerability exists due to an integer underflow in __unmap_hugepage_range() in the hugetlb memory-management component when unmapping a parent range whose folio remains mapped by a child. A local user can unmap the parent range before the child range to cause the reserved count to underflow.
The reserved count is restored when the child unmaps the range.
Affected software
Linux kernel
How to mitigate CVE-2026-89593
Install security update from vendor's repository.