CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix list corruption in allocate_file_region_entries()

allocate_file_region_entries() tops up resv->region_cache with freshly
allocated file_region descriptors.  The allocation uses GFP_KERNEL, so
resv->lock is dropped around it: the new entries are gathered on a
stack-local list head, allocated_regions, and spliced into
resv->region_cache once the lock is re-acquired.

The splice used list_splice(), which moves the entries but does not
re-initialize the source head, so allocated_regions is left pointing at an
entry that now lives on resv->region_cache.  The top-up runs in a while
loop that re-checks the cache deficit after re-acquiring the lock.  For a
shared mapping the resv_map is shared by every mapper of the hugetlbfs
inode, so a concurrent region_chg()/region_add()/region_del() on the same
resv_map can consume cache entries during the unlocked window and force a
second iteration.  That iteration calls list_add() on the stale head and
corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check
trips:

  list_add corruption. next->prev should be prev (ffffc900011ff7f8),
  but was ffff88814c281460. (next=ffff88814c545640).
  kernel BUG at lib/list_debug.c:31!
   allocate_file_region_entries+0x191/0x420
   region_chg+0x267/0x300
   hugetlb_reserve_pages+0x387/0xc80
   hugetlbfs_file_mmap+0x2ce/0x3f0
   mmap_region+0x1348/0x1a80
   do_mmap+0x85e/0xb90
   vm_mmap_pgoff+0x18c/0x330
   ksys_mmap_pgoff+0x2a1/0x3e0
   do_syscall_64+0xd7/0x420

Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack
address into resv->region_cache, leading to later use-after-free.

This was observed as a real host panic on a dense KVM host where a QEMU
guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate
SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one
shared resv_map.

Use list_splice_init() so the source head is re-initialized empty after
each splice, making the retry loop safe.

The Linux kernel CVE team has assigned CVE-2026-74518 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10 with commit d3ec7b6e09e512ba902b86bcca2c512fb06d492f and fixed in 6.6.151 with commit 62e1c2741a4d923d9854efd5927a6212aad7a187
	Issue introduced in 5.10 with commit d3ec7b6e09e512ba902b86bcca2c512fb06d492f and fixed in 6.12.103 with commit 587a0accc2b4fccc5cf7baf0fe34e50efde51f9c
	Issue introduced in 5.10 with commit d3ec7b6e09e512ba902b86bcca2c512fb06d492f and fixed in 6.18.44 with commit 126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df
	Issue introduced in 5.10 with commit d3ec7b6e09e512ba902b86bcca2c512fb06d492f and fixed in 7.1.8 with commit ac1bb7fd45088d0db57a22ce7729f258ebd63cf5
	Issue introduced in 5.10 with commit d3ec7b6e09e512ba902b86bcca2c512fb06d492f and fixed in 7.2-rc6 with commit dd9623f58ec702a07b2d67179d6fcea79c52231a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74518
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/hugetlb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187
	https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c
	https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df
	https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5
	https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a