{"id":"CVE-2026-98729","revision":"46a2884077f4490bb05b4d93ac18d1b5","records":[{"revision":"46a2884077f4490bb05b4d93ac18d1b5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98729","aliases":[],"title":"x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Don't apply va_align to hugetlb mappings on AMD F15h\n\nget_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits()\nadds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge\npage boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at\nteardown.\n\nThis can be triggered on Carrizo and FX-8370E, both hstates.\n\nPass the file to get_align_bits() and skip the randomisation for hugetlbfs.\n\n  [ bp: Massage commit message. ]","state":0,"publishedAt":"2026-10-18T15:47:06.633+00:00","modifiedAt":"2026-10-19T09:24:39.819+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/kernel/sys_x86_64.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0\",\n                            \"lessThan\": \"fe23680e6f1d52b8cc45d77bf7c54249508a81c7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0\",\n                            \"lessThan\": \"b46b2e2de47ca9449532b0a7110ed99f79061d6e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1317a5e7f7b1336eac4097f0ef4f5cd7ae72f1d0\",\n                            \"lessThan\": \"d2457a7e2727dc747a61a50d65c2f259afce8c45\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/kernel/sys_x86_64.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fe23680e6f1d52b8cc45d77bf7c54249508a81c7","https://git.kernel.org/stable/c/b46b2e2de47ca9449532b0a7110ed99f79061d6e","https://git.kernel.org/stable/c/d2457a7e2727dc747a61a50d65c2f259afce8c45"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98729","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98729","identifiers":["CVE-2026-98729"]},"retained":false,"historicalAffected":[]}],"coverage":[]}