CVE-2026-98373 mm/hugetlb: preserve mremap address delta when skipping page tables

Not scored Published 7 Oct 2026 Updated 21 Oct 2026

A local attacker can trigger a kernel panic in the Linux kernel's hugetlb subsystem via mremap, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98373?

CVE-2026-98373 is a memory corruption vulnerability in Linux, published on 7 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: preserve mremap address delta when skipping page tables

move_hugetlb_page_tables() optimizes mremap() by advancing to the last entry in the page table when the source page table does not exist, either initially or after unsharing a PMD table. The common loop increment then steps to the first entry in the next page table.

However, the code advances both the source and destination addresses to the last entries in their respective page tables, which is wrong. The destination address must be advanced only by the same amount as the source address.

If the source and destination offsets within their page tables differ, the destination address can be advanced too far, causing follow-up issues. Fix this by advancing the destination address by the source advance distance.

With a reproducer, we were able to trigger a kernel panic on x86-64. With this fix in place, we can no longer reproduce the issue.

Which versions are affected by CVE-2026-98373?

How do I fix CVE-2026-98373?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-98373 being exploited?

There is no known exploitation of CVE-2026-98373 in the wild and no public exploit code.

Sources

Also known as AZL-106730, BELL-CVE-2026-98373, DEBIAN-CVE-2026-98373, GHSA-7phr-r52q-xg92, UBUNTU-CVE-2026-98373.