CVE-2026-72213 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining and securing Linux-based systems, and security teams should be aware of this vulnerability. They should review and apply the provided kernel patches to address the issue and ensure that the Linux kernel is updated to a version that includes the fix. Additionally, they should monitor systems for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. Affected operators and platforms require immediate attention to prevent potential exploitation of this vulnerability. Vulnerability management and security teams should prioritize patching and verifying the integrity of affected systems. Linux kernel developers should also consider the impact on their development and testing workflows. The vulnerability management process should include tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Security teams should ensure that their incident response plans are updated to address this type of vulnerability. The affected Linux kernel versions and configurations should be carefully reviewed to ensure that all necessary patches are applied. System administrators should verify that their Linux-based systems are updated and patched accordingly. They should also review system logs and monitoring data for signs of potential exploitation. Furthermore, they should consider implementing compensating controls, such as enhanced monitoring and detection, to mitigate the risk of exploitation. By taking these steps, Linux kernel developers and administrators can help prevent the exploitation of this vulnerability and ensure the security and integrity of their Linux-based systems. Linux kernel developers and administrators should also consider the potential operational impact of this vulnerability on their systems and take steps to minimize downtime and ensure business continuity. The vulnerability highlights the importance of maintaining up-to-date Linux kernel versions and having robust vulnerability management processes in place. By prioritizing patching and verification, Linux kernel users can

Technical summary

The vulnerability is caused by a single h_cg pointer being used for both rsvd and non-rsvd hugetlb cgroup charges in alloc_hugetlb_folio(). This results in incorrect cgroup pointers being stored, leading to a page_counter underflow when the folio is freed. The issue has been resolved by introducing a separate h_cg_rsvd pointer exclusively for the rsvd charge path, keeping the rsvd and non-rsvd charges fully independent through their charge, commit, and error uncharge paths.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor systems for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a single h_cg pointer being used for both rsvd and non-rsvd hugetlb cgroup charges. This results in incorrect cgroup pointers being stored, leading to a page_counter underflow when the folio is freed. The issue has been resolved by introducing a separate h_cg_rsvd pointer exclusively for the rsvd charge path.

Official resources