https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:28:11 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47214 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>hugetlb, userfaultfd: fix reservation restore on userfaultfd error</p> <p>Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using &#34;goto out_release_unlock;&#34; in the cases where idx &gt;= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h-&gt;resv_hugepages causing a 100% reproducible leak.</p> <p>We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>hugetlb, userfaultfd: fix reservation restore on userfaultfd error</p> <p>Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using &#34;goto out_release_unlock;&#34; in the cases where idx &gt;= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h-&gt;resv_hugepages causing a 100% reproducible leak.</p> <p>We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.</p> https://cve.radiocsirt.org/vuln/cve-2021-47214