{
  "cveId": "CVE-2026-93232",
  "url": "https://patchblox.com/security/cve/CVE-2026-93232",
  "summary": "CVE-2026-93232 is fixed in linux on 1 platform by DEBIAN-CVE-2026-93232 (version 7.2.6-1), released September 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages  Patch series \u0022mm: Refactor bootmem gigantic hugepage allocation\u0022, v4.  This series is split out from the earlier larger series \u0022mm: Generalize HVO for HugeTLB and device DAX\u0022 [1].  It collects the first 19 patches of that series as a standalone set of fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup.  The first patches fix a few bugs found while reviewing the existing code, including incorrect bootmem HVO handling, wrong vmemmap registration arguments, a powerpc compound-vmemmap tracking bug, and too-late initialization of gigantic bootmem HugeTLB struct pages.  The rest of the series reorders early memory initialization so the relevant zone state is available before sparse and HugeTLB boot-time setup runs, then simplifies the remaining bootmem gigantic hugepage allocation path and removes code made obsolete by that rework.  At a high level:   - patches [1-4] fix boot-time and arch-specific bugs   - patches [5-12] reorder and simplify sparse/mm/hugetlb early init   - patches [13-19] refactor bootmem gigantic hugepage allocation and     remove obsolete helpers and state   This patch (of 19):  Commit 622026e87c40 (\u0022mm/hugetlb: remove fake head pages\u0022) switched HVO to reuse per-zone shared tail pages from zone-\u003Evmemmap_tails[].  Those shared tail pages were initialized in hugetlb_vmemmap_init(), but bootmem HugeTLB folios are prepared earlier from gather_bootmem_prealloc().  With hugetlb_free_vmemmap=on, prep_and_add_bootmem_folios() can access pageblock flags on bootmem HugeTLB pages whose mirrored tail struct pages already point to the shared tail page.  On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then dereferences the still-uninitialized shared tail page and can panic during boot.  Initialize zone-\u003Evmemmap_tails[] from gather_bootmem_prealloc(), before bootmem HugeTLB folios are processed, and drop the later initialization from hugetlb_vmemmap_init().  This bug only affects CONFIG_DEBUG_VM kernels, where the relevant assertion is evaluated.",
  "published": "2026-09-24T16:17:18Z",
  "severity": "",
  "epss": 0.00155,
  "epssPercentile": 0.0471,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93232",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93232",
      "released": "2026-09-24T19:30:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}