Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93230— mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： mm/hugetlb：更早地初始化巨型引导内存 HugeTLB 页结构体页面 目前，巨型引导内存 HugeTLB 页是从 进行初始化的，但 运行得更早，并且会遍历页块以判断区域的连续性。 如果某个引导内存 HugeTLB 区域被标记为 ， 可能会通过 观察到尚未初始化的 页面。这可能不会立即导致失败，但会导致 计算出错误的区域连续性状态。如果在此路径中增加了额外的中毒页面检查（例如 中的 ），还可能触发早期启动恐慌（boot panic）。 因此，建议在评估区域连续性之前，

AI Predicted 5.3 Difficulty: Moderate EPSS 0.17% · P5

Possible ATT&CK Techniques 1 AI

T1610 · Deploy Container

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40< 09505232eced5f1c42902d8f28740f070c3fc6dc affected
fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40< 29968bc7aefb3cf1e72aa7c5f52697a6b0527094 affected
fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40< b1b7c045e808c761b1cc8c19b3040fadedda3fef affected
6.7 affected
< 6.7 unaffected
6.18.51≤ 6.18.* unaffected
7.2.4≤ 7.2.* unaffected
7.3-rc1≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93230

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlb_init(), but page_alloc_init_late() runs earlier and walks pageblocks to determine zone contiguity. If a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can observe still-uninitialized struct pages through __pageblock_pfn_to_page(). This may not trigger an immediate failure, but it can make set_zone_contiguous() compute the wrong zone contiguity state. If extra poisoned-page checks are added in this path, such as PF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot panic. Initialize gigantic bootmem HugeTLB struct pages from page_alloc_init_late(), before zone contiguity is evaluated, so later page allocator setup only sees valid struct page state. This also makes the initialization order more natural, as struct pages should be initialized before later code inspects them.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40 ~ 09505232eced5f1c42902d8f28740f070c3fc6dc -
Linux Linux 6.7 -

II. Public POCs for CVE-2026-93230

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93230

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93230 (3)

Same Patch Batch · Linux · 2026-09-24 · 234 CVEs total

CVE-2026-93207 9.8 CRITICAL SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
CVE-2026-97413 9.8 CRITICAL RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
CVE-2026-93228 9.1 CRITICAL svcrdma: Reject Write/Reply chunks with segcount 0
CVE-2026-93793 8.8 HIGH wifi: iwlwifi: mvm: validate TX_CMD response layout
CVE-2026-93799 8.8 HIGH wifi: iwlwifi: mvm: validate sta_id in BA window status notif
CVE-2026-93790 8.8 HIGH wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
CVE-2026-93806 8.8 HIGH wifi: cfg80211: validate assoc response length before status and IE access
CVE-2026-97442 8.8 HIGH wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
CVE-2026-97509 8.8 HIGH thunderbolt: Keep XDomain reference during the lifetime of a service
CVE-2026-97409 8.8 HIGH nvme-fc: Do not cancel requests in io target before it is initialized
CVE-2026-93280 8.8 HIGH greybus: audio: bound the topology section sizes against the fetched size
CVE-2026-93284 8.8 HIGH drm/pagemap: dma-unmap pages before handling migration errors
CVE-2026-97451 8.4 HIGH ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
CVE-2026-97452 8.4 HIGH ACPICA: Prevent adding invalid references
CVE-2026-97455 8.4 HIGH ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
CVE-2026-97450 8.4 HIGH ACPICA: validate handler object type in two places
CVE-2026-93827 8.4 HIGH virtio-fs: avoid double-free on failed queue setup
CVE-2026-97433 8.2 HIGH nvme: validate FDP configuration descriptor sizes
CVE-2026-93221 8.1 HIGH nfsd: convert nfsd_net boolean flags to unsigned long flags word
CVE-2026-93786 8.1 HIGH ksmbd: preserve VFS inherited POSIX ACL mask

Showing top 20 of 234 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-93230

No comments yet

Leave a comment