CVE-2026-98729
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits() adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at teardown. This can be triggered on Carrizo and FX-8370E, both hstates. Pass the file to get_align_bits() and skip the randomisation for hugetlbfs. [ bp: Massage commit message. ]
Affected versions
Linux kernel versions
6.13
and later are affected. Fixed in
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-98729?
CVE-2026-98729 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.13 onward and has been patched in 6.18.56, 7.2.10 and 7.3. CVE-2026-98729 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98729?
Yes. CVE-2026-98729 has been patched. Fixed versions include 6.18.56, 7.2.10 and 7.3. If you are running Linux kernel 6.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98729 actively exploited?
No. CVE-2026-98729 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.