GHSA-4rhr-9xj2-x9gx · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix...
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb_pmd_shared() Patch series "mm/hugetlb: fixes for PMD table sharing (incl. using mmu_gather)", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I recently shared [1] for the performance fix, deferring most of the cleanups I had in the prototype to a later point. While doing that I identified the other things. The goal of this patch set is to be backported to stable trees "fairly" easily. At least patch #1 and #4. Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing Patch #2 + #3 are simple comment fixes that patch #4 interacts with. Patch #4 is a fix for the reported performance regression due to excessive IPI broadcasts during fork()+exit(). The last patch is all about TLB flushes, IPIs and mmu_gather. Read: complicated There are plenty of cleanups in the future to be had + one reasonable optimization on x86. But that's all out of scope for this series. Runtime tested, with a focus on fixing the performance regression using the original reproducer [2] on x86. This patch (of 4): We switched from (wrongly) using the page count to an independent shared count. Now, shared page tables have a refcount of 1 (excluding speculative references) and instead use ptdesc->pt_share_count to identify sharing. We didn't convert hugetlb_pmd_shared(), so right now, we would never detect a shared PMD table as such, because sharing/unsharing no longer touches the refcount of a PMD table. Page migration, like mbind() or migrate_pages() would allow for migrating folios mapped into such shared PMD tables, even though the folios are not exclusive. In smaps we would account them as "private" although they are "shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the pagemap interface. Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().
Conclusion & alert: CVE-2026-23100 is rated Low Risk (22.7/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.11%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.02% | 0.11% | +0.10% |
| 2 | 2026-02-05 | — | 0.02% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
GHSA-4rhr-9xj2-x9gx · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-23100 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. | https://security-tracker.debian.org/tracker/CVE-2026-23100 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2026-23100 |
suse
|
medium | CVE-2026-23100 severity moderate: SUSE including 140 source package names (2.2.1-5.81:libblkid1-2.40.4-slfo.1.1_4.1, 2.2.1-5.81:libfdisk1-2.40.4-slfo.1.1_4.1, …), 464 product×package rows across 53 product lines (Container suse/sl-micro/6.1/baremetal-os-container, Container suse/sl-micro/6.1/base-os-container, … (53 product lines)): Fixed 227, Known Not Affected 212, First Fixed 25. | https://www.suse.com/security/cve/CVE-2026-23100/ |
ubuntu
|
medium | CVE-2026-23100 medium priority: Ubuntu including 157 source packages (linux, linux-allwinner-5.19, …), 1256 status rows across 8 suites (bionic, focal, jammy, noble, questing, trusty, upstream, xenial): DNE 871, ignored 169, needed 87, released 83, not-affected 46. | https://ubuntu.com/security/CVE-2026-23100 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| linux | linux_kernel | >= 5.10.239, < 5.11 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 5.15.186, < 5.16 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.1.142, < 6.2 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.6.72, < 6.6.127 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.12.9, < 6.12.74 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.13.1, < 6.18.8 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | 6.13 | cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:* |
| linux | linux_kernel | 6.13 | cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* |
| linux | linux_kernel | 6.13 | cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:* |
| linux | linux_kernel | 6.19 | cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:* |
| linux | linux_kernel | 6.19 | cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* |
| linux | linux_kernel | 6.19 | cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:* |
| linux | linux_kernel | 6.19 | cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:* |
| linux | linux_kernel | 6.19 | cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:* |
| linux | linux_kernel | 6.19 | cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:* |