GHSA-ghpp-gwgc-8pq9 · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed...
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") fixed an underflow error for hstate->resv_huge_pages caused by incorrectly attributing globally requested pages to the subpool's reservation. Unfortunately, this fix also introduced the opposite problem, which would leave spool->used_hpages elevated if the globally requested pages could not be acquired. This is because while a subpool's reserve pages only accounts for what is requested and allocated from the subpool, its "used" counter keeps track of what is consumed in total, both from the subpool and globally. Thus, we need to adjust spool->used_hpages in the other direction, and make sure that globally requested pages are uncharged from the subpool's used counter. Each failed allocation attempt increments the used_hpages counter by how many pages were requested from the global pool. Ultimately, this renders the subpool unusable, as used_hpages approaches the max limit. The issue can be reproduced as follows: 1. Allocate 4 hugetlb pages 2. Create a hugetlb mount with max=4, min=2 3. Consume 2 pages globally 4. Request 3 pages from the subpool (2 from subpool + 1 from global) 4.1 hugepage_subpool_get_pages(spool, 3) succeeds. used_hpages += 3 4.2 hugetlb_acct_memory(h, 1) fails: no global pages left used_hpages -= 2 5. Subpool now has used_hpages = 1, despite not being able to successfully allocate any hugepages. It believes it can now only allocate 3 more hugepages, not 4. With each failed allocation attempt incrementing the used counter, the subpool eventually reaches a point where its used counter equals its max counter. At that point, any future allocations that try to allocate hugeTLB pages from the subpool will fail, despite the subpool not having any of its hugeTLB pages consumed by any user. Once this happens, there is no way to make the subpool usable again, since there is no way to decrement the used counter as no process is really consuming the hugeTLB pages. The underflow issue that the original commit fixes still remains fixed as well. Without this fix, used_hpages would keep on leaking if hugetlb_acct_memory() fails.
Conclusion & alert: CVE-2026-43286 is rated Low Risk (22.9/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.12%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.02% | 0.12% | +0.10% |
| 2 | 2026-05-09 | — | 0.02% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
GHSA-ghpp-gwgc-8pq9 · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2026-43286 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-43286 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2026-43286 |
suse
|
medium | CVE-2026-43286 severity moderate: SUSE including 21 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 198 product×package rows across 39 product lines (SUSE Linux Enterprise High Availability Extension 15 SP7, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, … (39 product lines)): Known Not Affected 198. | https://www.suse.com/security/cve/CVE-2026-43286/ |
ubuntu
|
medium | CVE-2026-43286 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 169, not-affected 122, released 83, needed 22, needs-triage 5. | https://ubuntu.com/security/CVE-2026-43286 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| linux | linux_kernel | >= 6.14.8, < 6.15 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.15.1, < 6.18.16 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.19, < 6.19.6 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | 6.15 | cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |