CVE-2026-72213

This vulnerability in the kernel's hugetlb cgroup controller is significantly worse than its CVSS 7.1 suggests. The core issue is not an accounting error but a use-after-free-adjacent trust boundary violation: the folio structure stores a cgroup pointer that does not match the physical reality of which cgroup was originally charged. When the folio is freed, the kernel reads this poisoned pointer and issues an uncharge to the wrong container — container A can cause kernel resource counters for container B to decrement, directly violating cgroup isolation guarantees. The kernel's WARNING at page_counter_cancel fires after the contamination has already occurred, not before. The damage to page_counter state is done; the splat is diagnostic, not preventive. This matters because cgroup page counters are the enforcement mechanism for memory controller limits — corruption here means the kernel may make memory pressure decisions based on invalid resource state. This is the third distinct cgroup pointer aliasing bug in the hugetlb path in five years, following CVE-2019-18222 and CVE-2022-47946. Each instance receives the same fix — introducing a second pointer — rather than API-level enforcement that would prevent the pattern by construction. The hugetlb subsystem receives less scrutiny as transparent huge pages have consumed most workloads, making it a sediment layer where aliasing errors accumulate. A critical question remains unresolved: can an unprivileged container manipulate the map_chg condition to force entry into the reserved charge path at a chosen moment? If map_chg manipulation is possible, this transforms from an accidental underflow to a selectable corruption vector against sibling containers sharing a node — a fundamentally different risk profile closer to a denial-of-service mechanism against container isolation than an accounting edge case. Deployments running hugetlb with memory controller limits should prioritize this patch despite the moderate CVSS score. Monitor for WARNING splats in dmesg referencing page_counter_cancel, which indicate the underflow condition was triggered. The blast radius is bounded by containers sharing a node, but that surface is substantial in containerized production environments.

Reviewed through automated stages and approved by a human before publication.