CVE-2026-90283

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90283
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90283.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90283
Downstream
Published
2026-09-17T16:08:13Z
Modified
2026-09-18T03:48:37Z
Summary
hugetlbfs: release subpool on fill_super failure
Details

In the Linux kernel, the following vulnerability has been resolved:

hugetlbfs: release subpool on fill_super failure

hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size.

If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged.

Use hugepage_put_subpool() on the failure path, matching the normal put_super path.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90283.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7ca02d0ae586fe7df59632966a64f3f1a756ef05
Fixed
f2d6cea221d777fab3ba18f805ba4c17c90e0b8b
Fixed
91c4f3a87862fd86594d5945512decbfa0b1d13d
Fixed
04f0354a4abf6793aa5b3f32e2b019ab206f344d
Fixed
5b7fc7a1ce2a5f2cd8ed80a883157c7108074e0b
Fixed
1d8be4ee81e73fcc52e58f47842d9a2277cfeaaa
Fixed
dfe848cadfde4179a0691da34f4bed36ff7185b5
Fixed
dc2bd517ac0bce4ec7498644bd16b6db502df8e2
Fixed
308ab73e97c87bd0e142b11758faab7f88d82854

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90283.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
5.10.270
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.221
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.157
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90283.json"