# CVE-2026-89966: linux: In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb_cma: fix null nodemask dereference in...

CVE-2026-89966 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89966 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-89966
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 16, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio  alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to alloc_fresh_hugetlb_folio() as a fallback to allocate from all nodes.  If order is gigantic, alloc_fresh_hugetlb_folio() propagates the NULL nodemask down to hugetlb_cma_alloc_frozen_folio() via alloc_gigantic_frozen_folio().  Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted allocation on hugetlb_cma[nid] without verifying if nid is included in the caller's nodemask.  Adding a node_isset(nid, *nodemask) check ensures the initial preferred node allocation honors the memory policy / nodemask.  However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask), leading to a null pointer dereference kernel panic when nodemask is NULL.  Fix this by checking if nodemask is NULL in hugetlb_cma_alloc_frozen_folio() and defaulting it to cpuset_current_mems_allowed.  Enclose the allocation attempts within the cpuset seqcount retry loop so that if the cpuset changes concurrently during allocation, the attempts are retried using the updated nodemask.  This ensures that the initial node check and fallback loop safely honor the task's cpuset without violating cpuset constraints or causing NULL pointer dereferences or unexpected allocation failures.  From a userspace perspective, this bug allows an unprivileged user to crash the kernel (trigger a panic) by requesting a gigantic hugepage allocation with MPOL_PREFERRED_MANY on a system where CMA is only configured on a subset of NUMA nodes.  This can be reproduced by booting a VM with two NUMA nodes, restricting CMA to Node 1 (e.g., hugetlb_cma=1:1G default_hugepagesz=1G hugepagesz=1G hugepages=0), and running a program that allocates a 1GB hugepage area without reserving, restricts allocation to Node 0 using mbind() with MPOL_PREFERRED_MANY, and triggers a page fault:    void *ptr = mmap(NULL, 1UL << 30, PROT_READ | PROT_WRITE,                    MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB |                    MAP_HUGE_1GB | MAP_NORESERVE, -1, 0);   unsigned long nodemask = 1; /* Node 0 */   mbind(ptr, 1UL << 30, MPOL_PREFERRED_MANY, &nodemask,         sizeof(nodemask) * 8, 0);   memset(ptr, 0, 1UL << 30); /* Trigger fault */  This results in a NULL pointer dereference:    BUG: kernel NULL pointer dereference, address: 0000000000000000   #PF: supervisor read access in kernel mode   #PF: error_code(0x0000) - not-present page   Oops: Oops: 0000 [#1] SMP NOPTI   RIP: 0010:hugetlb_cma_alloc_frozen_folio+0x75/0x120   Call Trace:    <TASK>    only_alloc_fresh_hugetlb_folio.isra.0+0x2c/0x160    alloc_surplus_hugetlb_folio+0x6d/0x100    alloc_hugetlb_folio+0x3c5/0x660    hugetlb_no_page+0x3d9/0x650

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-89966](https://patchblox.com/security/data/fix/linux/debian-cve-2026-89966.md) | Sep 23, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.