{"id":"CVE-2026-98506","kind":"vulnerability","aliases":["CVE-2026-98506"],"related":[],"title":"Linux kernel: hugetlb gigantic page dissolve can corrupt the free list","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: do not dissolve gigantic pages without runtime support\n\ndissolve_free_hugetlb_folio() doesn't check\nhstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/\nupdate_and_free_hugetlb_folio() silently bail for such folios, so it frees\na still-listed folio and, on vmemmap restore failure, the\nadd_hugetlb_folio() rollback corrupts the free list.","summary":"In the Linux kernel's hugetlb memory code, dissolving a free gigantic page does not check whether runtime support exists, so the page can be freed while still on the free list. On a vmemmap restore failure, the rollback then corrupts the free list, which can crash the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","other","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the sources list affected kernel version ranges","fix":"- Update to a Linux kernel release that includes the upstream fix for CVE-2026-98506; the sources do not name a fixed version\n- unknown whether distribution kernel packages already carry the patch","status":"open","published_at":"2026-10-18T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:27+00:00","updated_at":"2026-10-25T05:25:27+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-25T05:25:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix for CVE-2026-98506; the sources do not name a fixed version\n- unknown whether distribution kernel packages already carry the patch","reach":"local","title":"Linux kernel: hugetlb gigantic page dissolve can corrupt the free list","impact":"medium","summary":"In the Linux kernel's hugetlb memory code, dissolving a free gigantic page does not check whether runtime support exists, so the page can be freed while still on the free list. On a vmemmap restore failure, the rollback then corrupts the free list, which can crash the kernel.","category":"other","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.3,"needs_auth":"unknown","worst_case":"Kernel memory corruption; attacker impact beyond a crash is unknown.","analyst_note":"Find the NVD entry's CVSS score and affected kernel version ranges, and the upstream stable commit that fixes it, to confirm exposure and the fixed version.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the sources list affected kernel version ranges","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with hugetlb gigantic pages in use, where runtime gigantic page support is absent and memory is freed or dissolved at runtime. The sources do not describe a specific configuration, so the exact exposure is unknown. Hosts that never allocate hugetlb gigantic pages are probably less exposed, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000638,"input_tokens":3395,"output_tokens":598,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98506':14A,17A 'add':133C 'bail':115C 'check':39B,98C 'code':31B 'corrupt':8A,64B,137C 'crash':70B 'cve':12A,15A 'dissolv':6A,32B,86C,92C 'doesn':96C 'exist':43B 'failur':60B,131C 'folio':95C,108C,113C,118C,126C,135C 'follow':78C 'free':10A,34B,54B,66B,93C,111C,121C,139C 'freed':49B 'gigant':4A,35B,87C,101C 'h':104C 'host':23B 'hstate':99C 'hugetlb':3A,29B,94C,107C,112C,134C 'kernel':2A,18B,27B,72B,76C 'linux':1A,19B,26B,75C 'list':11A,55B,67B,125C,140C 'memori':30B 'mm/hugetlb':83C 'page':5A,36B,46B,88C 'remov':106C 'resolv':82C 'restor':59B,130C 'rollback':62B,136C 'runtim':41B,90C,103C 'self':22B 'self-host':21B 'silent':114C 'still':51B,124C 'still-list':123C 'support':42B,91C 'though':105C 'updat':109C 'vmemmap':58B,129C 'vulner':79C 'whether':40B 'without':89C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with hugetlb gigantic pages in use, where runtime gigantic page support is absent and memory is freed or dissolved at runtime. The sources do not describe a specific configuration, so the exact exposure is unknown. Hosts that never allocate hugetlb gigantic pages are probably less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98506","severity":null,"published_at":"2026-10-18T16:17:01+00:00","modified_at":"2026-10-19T10:19:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}