PT-2026-38928 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43286

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the hugetlb memory management where failed global reservations are not correctly restored to the subpool. Specifically, when globally requested pages cannot be acquired, the spool->used hpages counter remains elevated. Because the used counter tracks total consumption from both the subpool and global pools, failed allocation attempts cause the used hpages counter to increment without a corresponding decrement. Over time, this leads to a leak where the used counter eventually reaches the maximum limit, rendering the subpool unusable as all future allocation attempts fail, even if no pages are actually being consumed by any user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-43286

Affected Products

Linux Kernel

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43286 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43286 · Vendor Advisory
• https://git.kernel.org/stable/c/1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5 · Patch
• https://git.kernel.org/stable/c/5eac1322a7b14b8cd05ec896618278b90fba7f39 · Patch
• https://git.kernel.org/stable/c/f055897c975d079a90af873c791ab58cf0f6f2a5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43286 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43286 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43286 · Security Note
• https://twitter.com/CVEnew/status/2053174663069475064 · Twitter Post
• https://t.me/cveNotify/163641 · Telegram Post
• https://git.kernel.org/linus/1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5 · Note
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post