CVE-2026-72213

A flaw was found in the Linux kernel's huge page memory management (hugetlb). A mismatch in how reserved and non-reserved huge page control group (cgroup) charges are handled during memory allocation and deallocation can lead to an incorrect cgroup being uncharged. This issue results in a page counter underflow, which a local attacker could potentially leverage to cause a denial of service.

This vulnerability is rated as Moderate impact because exploitation requires local authenticated access and specific control group interactions with huge page allocations, limiting the potential blast radius to a localized denial of service. Under standard enterprise configurations, the accounting desynchronization between reserved and active huge page allocations triggers internal kernel warnings and state corruption upon memory deallocation. Because the issue cannot be triggered remotely and does not permit arbitrary code execution or data leakage, the overall risk to system integrity and confidentiality remains constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.