CVE-2026-98506 mm/hugetlb: do not dissolve gigantic pages without runtime support
A local attacker can corrupt the hugetlb free list by dissolving gigantic pages without runtime support, potentially causing a system crash or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98506?
CVE-2026-98506 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: do not dissolve gigantic pages without runtime support
dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/ update_and_free_hugetlb_folio() silently bail for such folios, so it frees a still-listed folio and, on vmemmap restore failure, the add_hugetlb_folio() rollback corrupts the free list.
Which versions are affected by CVE-2026-98506?
How do I fix CVE-2026-98506?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98506 being exploited?
There is no known exploitation of CVE-2026-98506 in the wild and no public exploit code.
Sources
Also known as AZL-109293, BELL-CVE-2026-98506, DEBIAN-CVE-2026-98506, GHSA-rgpg-w634-4pfv, UBUNTU-CVE-2026-98506.