{"apiVersion":"1.0","identifier":"CVE-2026-72213","description":"In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set, hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg with the non-rsvd cgroup pointer. As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong (non-rsvd) cgroup pointer into the folio-s rsvd slot. When the folio is later freed, free_huge_folio() unconditionally calls both hugetlb_cgroup_uncharge_folio() and hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the wrong cgroup from the folio and decrements a counter that was never charged for that cgroup, causing a page_counter underflow: page_counter underflow: -512 nr_pages=512 WARNING: mm/page_counter.c:61 at page_counter_cancel Fix this by introducing a separate h_cg_rsvd pointer exclusively for the rsvd charge path, keeping the rsvd and non-rsvd charges fully independent through their charge, commit, and error uncharge paths.","publishedAt":"2026-08-15T06:21:40","lastModifiedAt":"2026-08-17T06:18:22","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72213","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","epssProbability":0.00159,"riskScore":0.72,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72213","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72213","en":"https://www.redsauce.net/en/cves/CVE-2026-72213","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72213","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72213","de":"https://www.redsauce.net/de/cves/CVE-2026-72213","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72213","el":"https://www.redsauce.net/el/cves/CVE-2026-72213"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72213"}}