CVE-2026-98373: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98373 is a Linux kernel vulnerability in the mm/hugetlb subsystem involving incorrect address advancement during mremap() operations with hugetlb page tables. The flaw exists in move_hugetlb_page_tables(), which incorrectly advances both source and destination addresses by the full page table offset when skipping non-existent page tables, rather than advancing the destination only by the same delta as the source. This can trigger a kernel panic on x86-64 systems. The vulnerability affects Linux kernel versions from 6.0 onward, with fixes available in versions 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.156% (Github Advisory, Feedly).

The root cause is an off-by-delta logic error (related to CWE-682: Incorrect Calculation) in move_hugetlb_page_tables() within the Linux kernel's hugetlb memory management code. When mremap() is called and the source page table does not exist — either initially or after unsharing a PMD table — the optimization loop advances both the source and destination virtual addresses to the last entry of their respective page tables independently. Because the source and destination may have different offsets within their page tables, the destination address can be advanced further than intended, causing memory corruption or misaligned state. The fix corrects this by computing the source advance distance and applying that same delta to the destination address (Github Advisory).

Successful exploitation results in a kernel panic (system crash), constituting a Denial of Service against the affected host. The vulnerability is locally exploitable — a local user with the ability to invoke mremap() with specific hugetlb page table configurations can crash the system. There is no evidence of confidentiality or integrity impact beyond system availability, and no lateral movement potential has been identified (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access to trigger via the mremap() system call with hugetlb mappings. The EPSS score is approximately 0.156% (4th percentile), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

Apply the available kernel patches that correct the destination address advancement logic in move_hugetlb_page_tables(). Fixed versions are Linux kernel 6.12.112 (for the 6.12.x stable branch), 6.18.55 (for the 6.18.x stable branch), 7.2.9 (for the 7.2.x stable branch), and 7.3-rc5 or later. Patch commits are available at the kernel stable repository. Systems running kernel versions prior to 6.0 are unaffected. Administrators should update to a patched kernel version as soon as it is available for their distribution (Github Advisory, Feedly).