CVE-2022-49828: hugetlbfs: don't delete error page from pagecache

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-01 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: don't delete error page from pagecache This change is very similar to the change that was made for shmem [1], and it solves the same problem but for HugeTLBFS instead. Currently, when poison is found in a HugeTLB page, the page is removed from the page cache. That means that attempting to map or read that hugepage in the future will result in a new hugepage being allocated instead of notifying the user that the page was poisoned. As [1] states, this is effectively memory corruption. The fix is to leave the page in the page cache. If the user attempts to use a poisoned HugeTLB page with a syscall, the syscall will fail with EIO, the same error code that shmem uses. For attempts to map the page, the thread will get a BUS_MCEERR_AR SIGBUS. [1]: commit a76054266661 ("mm: shmem: don't truncate page if memory failure happens")

Affected products

Linux kernel: before 5.15.80; from 5.16 before 6.0.10; 6.1-rc1, 6.1-rc2, 6.1-rc3, 6.1-rc4 — fixed in 5.15.80, 6.0.10

How to fix

Upgrade to a fixed version: Linux kernel 5.15.80, 6.0.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49828 or the next vulnerability affects your stack