{"id":"CVE-2026-98729","kind":"vulnerability","aliases":["CVE-2026-98729"],"related":[],"title":"Linux kernel: hugetlb mappings on AMD F15h can trigger teardown crash","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Don't apply va_align to hugetlb mappings on AMD F15h\n\nget_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits()\nadds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge\npage boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at\nteardown.\n\nThis can be triggered on Carrizo and FX-8370E, both hstates.\n\nPass the file to get_align_bits() and skip the randomisation for hugetlbfs.\n\n  [ bp: Massage commit message. ]","summary":"On AMD F15h x86 systems, the kernel applies a randomised alignment to hugetlbfs mappings, so mapped addresses fall off the huge page boundary. Teardown then hits a BUG_ON in __unmap_hugepage_range, which crashes the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-f15h","hugetlbfs","infrastructure","linux-kernel","x86"],"not_affected_if":["no-hugetlbfs-use","non-amd-f15h-cpu"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:15+00:00","updated_at":"2026-10-25T05:17:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: hugetlb mappings on AMD F15h can trigger teardown crash","impact":"low","summary":"On AMD F15h x86 systems, the kernel applies a randomised alignment to hugetlbfs mappings, so mapped addresses fall off the huge page boundary. Teardown then hits a BUG_ON in __unmap_hugepage_range, which crashes the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","x86","amd-f15h","hugetlbfs"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel crash (denial of service) during huge page unmap","analyst_note":"Find the affected and fixed kernel versions and the stable backport commit in the NVD entry or the upstream kernel git log.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-amd-f15h-cpu","no-hugetlbfs-use"],"who_is_affected":"Systems running Linux on AMD F15h-class x86 CPUs (the sources name Carrizo and FX-8370E) that use hugetlbfs huge page mappings. The sources do not say which kernel versions are fixed or affected beyond this commit. Systems without AMD F15h hardware or without hugetlbfs use are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3461,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98729':14A,17A '8370e':138C 'add':100C 'address':43B,109C 'align':37B,79C,87C,93C,98C,146C 'amd':6A,19B,28B,84C 'amd-f15h':18B 'appli':34B,77C 'area':106C 'bit':99C,147C 'boundari':49B,114C 'bp':154C 'bug':54B,120C 'carrizo':134C 'commit':156C 'crash':11A,61B 'cve':12A,15A 'f15h':7A,20B,29B,85C 'fall':44B 'file':143C 'follow':69C 'fx':137C 'fx-8370e':136C 'get':86C,97C,145C 'h':126C 'hit':52B,119C 'hstate':140C 'huge':47B,90C,112C,123C 'hugepag':58B,117C 'hugetlb':3A,81C 'hugetlbf':21B,39B,95C,153C 'infrastructur':22B 'kernel':2A,25B,33B,63B,67C 'linux':1A,24B,66C 'linux-kernel':23B 'map':4A,40B,42B,82C 'mask':88C,92C,125C 'massag':155C 'messag':157C 'page':48B,91C,113C,124C 'pass':141C 'randomis':36B,151C 'rang':59B,118C 'regardless':102C 'resolv':73C 'return':89C,107C 'skip':149C 'start':122C 'system':31B 'teardown':10A,50B,128C 'trigger':9A,132C 'unmap':57B,105C,116C 'va':78C 'va_align.bits':101C 'vm':104C 'vulner':70C 'x86':26B,30B 'x86/mm':74C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux on AMD F15h-class x86 CPUs (the sources name Carrizo and FX-8370E) that use hugetlbfs huge page mappings. The sources do not say which kernel versions are fixed or affected beyond this commit. Systems without AMD F15h hardware or without hugetlbfs use are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98729","severity":null,"published_at":"2026-10-18T16:17:26+00:00","modified_at":"2026-10-19T10:19:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}