CVE-2026-89593

A flaw was found in the Linux kernel's huge page (hugetlb) subsystem. This vulnerability occurs when a huge page of memory is shared between a parent and a child process. If the parent process unmaps the huge page before the child, the system can incorrectly reduce the count of reserved huge pages. This error can lead to system instability or a denial of service, making the system unresponsive or unavailable.

A flaw was found in the Linux kernel's huge page (hugetlb) subsystem, rated LOW impact by Red Hat. Since the introduction of reservation adjustments in __unmap_hugepage_range(), when a huge page is mapped in both a parent and a child process and the parent unmaps the range first, the reservation adjustment causes the reserved huge page count to underflow until the child also unmaps the range. A local unprivileged user able to set up and unmap shared hugetlb mappings could exploit this incorrect reservation accounting to cause system instability or a denial of service; there is no confidentiality or integrity impact. Red Hat Enterprise Linux 7 and 8, earlier Red Hat Enterprise Linux 9 streams, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present in their kernels. For the affected Red Hat Enterprise Linux 9 and 10 streams and OpenShift Container Platform 4.19 and later, the fix is deferred because the assessed severity does not meet the threshold for prioritizing a fix; the residual risk is limited to local denial of service through incorrect hugetlb reservation accounting. The upstream CVE record scores this flaw 7.1 (IMPORTANT, including integrity impact), while Red Hat's assessment is 5.5 (MODERATE, availability impact only), reflecting Red Hat's evaluation that only availability is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.