CVE-2026-89966

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to

alloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes. If

order is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL

nodemask down to hugetlb_cma_alloc_frozen_folio() via

alloc_gigantic_frozen_folio().

Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted

allocation on hugetlb_cma[nid] without verifying if nid is included in the

caller's nodemask. Adding a node_isset(nid, *nodemask) check ensures the

initial preferred node allocation honors the memory policy / nodemask.

However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in

node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask),

leading to a null pointer dereference kernel panic when nodemask is NULL.

Fix this by checking if nodemask is NULL in

hugetlb_cma_alloc_frozen_folio() and defaulting it to

cpuset_current_mems_allowed. Enclose the allocation attempts within the

cpuset seqcount retry loop so that if the cpuset changes concurrently

during allocation, the attempts are retried using the updated nodemask.

This ensures that the initial node check and fallback loop safely honor

the task's cpuset without violating cpuset constraints or causing NULL

pointer dereferences or unexpected allocation failures.

From a userspace perspective, this bug allows an unprivileged user to

crash the kernel (trigger a panic) by requesting a gigantic hugepage

allocation with MPOL_PREFERRED_MANY on a system where CMA is only

configured on a subset of NUMA nodes.

This can be reproduced by booting a VM with two NUMA nodes, restricting

CMA to Node 1 (e.g., hugetlb_cma=1:1G default_hugepagesz=1G hugepagesz=1G

hugepages=0), and running a program that allocates a 1GB hugepage area

without reserving, restricts allocation to Node 0 using mbind() with

MPOL_PREFERRED_MANY, and triggers a page fault:

void *ptr = mmap(NULL, 1UL << 30, PROT_READ | PROT_WRITE,

MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB |

MAP_HUGE_1GB | MAP_NORESERVE, -1, 0);

unsigned long nodemask = 1; /* Node 0 */

mbind(ptr, 1UL << 30, MPOL_PREFERRED_MANY, &nodemask,

sizeof(nodemask) * 8, 0);

memset(ptr, 0, 1UL << 30); /* Trigger fault */

This results in a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

Oops: Oops: 0000 [#1] SMP NOPTI

RIP: 0010:hugetlb_cma_alloc_frozen_folio+0x75/0x120

Call Trace:

<TASK>

only_alloc_fresh_hugetlb_folio.isra.0+0x2c/0x160

alloc_surplus_hugetlb_folio+0x6d/0x100

alloc_hugetlb_folio+0x3c5/0x660

hugetlb_no_page+0x3d9/0x650