CVE-2026-53154 Overview
CVE-2026-53154 is a Linux kernel vulnerability in the hugetlb memory management subsystem. The issue resides in mm/hugetlb.c, where two code paths allocate a hugetlb folio via alloc_hugetlb_folio() and then call copy_user_large_folio(). Since commit 1cb9dc4b475c introduced an integer return value for hwpoison recovery, the copy can fail with -EHWPOISON. On the failure path, the per-VMA reservation map entry is left marked consumed even though folio_put() returns the folio to the global pool. The defect leaks reservations and can lead to SIGBUS delivery at addresses a process previously reserved.
Critical Impact
A failed UFFDIO_COPY into a private hugetlb VMA leaks the reservation, causing subsequent faults at the same address to receive SIGBUS under hugetlb pool pressure.
Affected Products
- Linux kernel versions containing commit 1cb9dc4b475c ("mm: hwpoison: support recovery from HugePage copy-on-write faults") prior to the fix
- Systems using hugetlb pages with userfaultfd (UFFDIO_COPY) on private VMAs
- Systems performing fork-time copy-on-write on pinned hugetlb anonymous folios
Discovery Timeline
- 2026-06-25 - CVE-2026-53154 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53154
Vulnerability Analysis
The vulnerability is a reservation accounting error in the Linux kernel hugetlb subsystem. Two sites in mm/hugetlb.c allocate a hugetlb folio by calling alloc_hugetlb_folio(), which consumes a VMA reservation. They then call copy_user_large_folio() to copy user data into the new folio. After commit 1cb9dc4b475c, this copy routine returns an integer and can fail, for example with -EHWPOISON when the source page is hardware-poisoned.
On the failure path, the kernel calls folio_put(), which routes through free_huge_folio() and restores the global hugetlb pool count. However, the per-VMA reserve map entry remains marked consumed. The reservation is effectively orphaned: accounted against the VMA but not backed by any folio.
The two affected sites are the hugetlb_mfill_atomic_pte() resubmission path used by UFFDIO_COPY, and the copy_hugetlb_page_range() fork-time CoW path when hugetlb_try_dup_anon_rmap() fails on a pinned hugetlb anonymous folio.
Root Cause
The root cause is a missing restore_reserve_on_error() call on the failure path of copy_user_large_folio(). The reservation consumption performed during folio allocation is not undone when the copy fails, breaking the invariant between the VMA reserve map and the pool accounting.
Attack Vector
An unprivileged local process using userfaultfd can trigger the leak by inducing UFFDIO_COPY resubmission failures into a private hugetlb VMA. A subsequent fault at the same address takes the no-reservation path. Under hugetlb pool pressure, the kernel delivers SIGBUS to the task at an address it had previously reserved. The fork-time CoW path produces the same leak in the child VMA, but requires the rare combination of a pinned hugetlb anonymous page and a hwpoisoned source. The result is a denial-of-service condition against workloads relying on hugetlb reservations.
No verified exploit code is available. Technical details are documented in the upstream commits referenced in the Kernel Git Commit 40c8185 and related stable backports.
Detection Methods for CVE-2026-53154
Indicators of Compromise
- Unexpected SIGBUS signals delivered to processes using hugetlb-backed memory on addresses that were previously reserved.
- Kernel log entries referencing hwpoison events (MCE: Killing / Memory failure) correlated with hugetlb workloads using userfaultfd.
- Divergence between /proc/meminfo HugePages counters and per-VMA reservation accounting observed in /proc/<pid>/smaps.
Detection Strategies
- Monitor process termination events caused by SIGBUS on tasks using hugetlbfs and userfaultfd().
- Audit kernel versions against the fix commits 40c81856e622, 45e33d43243d, 8d6e1dd3ad13, c72469ac0f27, and e47bf16af3c4 to confirm patch presence.
- Correlate mce / hwpoison events with userfaultfd activity on hugetlb VMAs to identify reservation-leak preconditions.
Monitoring Recommendations
- Track HugePages_Free, HugePages_Rsvd, and HugePages_Total over time to detect reservation drift.
- Alert on repeated UFFDIO_COPY failures returning -EHWPOISON from hugetlb-backed memory regions.
- Centralize kernel dmesg output for hwpoison and hugetlb subsystem warnings in your log analytics pipeline.
How to Mitigate CVE-2026-53154
Immediate Actions Required
- Apply the upstream stable kernel update that adds restore_reserve_on_error() on the failure paths in mm/hugetlb.c.
- Inventory hosts running affected kernel versions, prioritizing systems that use hugetlb with userfaultfd (databases, VMs, high-performance workloads).
- Rebuild and redeploy custom or vendor kernels with the relevant stable backport applied.
Patch Information
The fix adds the missing restore_reserve_on_error() call before folio_put() on both error paths in mm/hugetlb.c. The relevant upstream and stable commits are Kernel Git Commit 40c8185, Kernel Git Commit 45e33d4, Kernel Git Commit 8d6e1dd, Kernel Git Commit c72469a, and Kernel Git Commit e47bf16.
Workarounds
- Restrict use of userfaultfd() to privileged users by setting vm.unprivileged_userfaultfd=0 until patched kernels are deployed.
- Avoid running workloads that combine hugetlb private mappings with userfaultfd on hosts known to have hardware-poisoned memory.
- Maintain headroom in the hugetlb pool so reservation drift does not immediately translate into SIGBUS delivery.
# Configuration example
# Restrict unprivileged userfaultfd usage as a temporary mitigation
sysctl -w vm.unprivileged_userfaultfd=0
echo 'vm.unprivileged_userfaultfd=0' > /etc/sysctl.d/99-cve-2026-53154.conf
# Verify kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
