CVE-2026-72213

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In allochugetlbfolio(), a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd() stores the charged cgroup in hcg, but the immediately following hugetlbcgroupchargecgroup() overwrites h_cg with the non-rsvd cgroup pointer.

As a result, hugetlbcgroupcommitchargersvd() stores the wrong (non-rsvd) cgroup pointer into the folio's rsvd slot.

When the folio is later freed, freehugefolio() unconditionally calls both hugetlbcgroupunchargefolio() and hugetlbcgroupunchargefoliorsvd(). The rsvd uncharge reads back the wrong cgroup from the folio and decrements a counter that was never charged for that cgroup, causing a pagecounter underflow:

pagecounter underflow: -512 nrpages=512 WARNING: mm/pagecounter.c:61 at pagecounter_cancel

Fix this by introducing a separate hcgrsvd pointer exclusively for the rsvd charge path, keeping the rsvd and non-rsvd charges fully independent through their charge, commit, and error uncharge paths.