mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages

Description

In the Linux kernel, the following vulnerability has been resolved: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages The h->*_huge_pages counters are protected by the hugetlb_lock, but alloc_huge_page has a corner case where it can decrement the counter outside of the lock. This could lead to a corrupted value of h->resv_huge_pages, which we have observed on our systems. Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a potential race.

Scores

EPSS (exploitation in 30 days)

0.16% · top 95% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Affected products

• Linux · Linux

  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 3e50a07b6a5fcd39df1534d3fdaca4292a65efe6
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 629c986e19fe9481227c7cdfd9a105bbc104d245
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 2b35432d324898ec41beb27031d2a1a864a4d40e
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 11993652d0b49e27272db0a37aa828d8a3a4b92b
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 568e3812b1778b4c0c229649b59977d88f400ece
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 112a005d1ded04a4b41b6d01833cc0bda90625cc
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < c828fab903725279aa9dc6ae3d44bb7e4778f92c
  • affected a88c769548047b21f76fd71e04b6a3300ff17160 – < 12df140f0bdfae5dcfc81800970dd7f6f632e00c
  • affected 3f5fae4d1a3189d95b02b4b45e1218df147122bc
  • affected 4.3.6 – < 4.4

• Linux · Linux

  • affected 4.4
  • unaffected < 4.4
  • unaffected 4.9.332 – ≤ 4.9.*
  • unaffected 4.14.298 – ≤ 4.14.*
  • unaffected 4.19.264 – ≤ 4.19.*
  • unaffected 5.4.223 – ≤ 5.4.*
  • unaffected 5.10.153 – ≤ 5.10.*
  • unaffected 5.15.76 – ≤ 5.15.*
  • unaffected 6.0.6 – ≤ 6.0.*
  • unaffected 6.1 – ≤ *

References (8)

• https://git.kernel.org/stable/c/3e50a07b6a5fcd39df1534d3fdaca4292a65efe6 (opens in a new tab)
• https://git.kernel.org/stable/c/629c986e19fe9481227c7cdfd9a105bbc104d245 (opens in a new tab)
• https://git.kernel.org/stable/c/2b35432d324898ec41beb27031d2a1a864a4d40e (opens in a new tab)
• https://git.kernel.org/stable/c/11993652d0b49e27272db0a37aa828d8a3a4b92b (opens in a new tab)
• https://git.kernel.org/stable/c/568e3812b1778b4c0c229649b59977d88f400ece (opens in a new tab)
• https://git.kernel.org/stable/c/112a005d1ded04a4b41b6d01833cc0bda90625cc (opens in a new tab)
• https://git.kernel.org/stable/c/c828fab903725279aa9dc6ae3d44bb7e4778f92c (opens in a new tab)
• https://git.kernel.org/stable/c/12df140f0bdfae5dcfc81800970dd7f6f632e00c (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-50285](https://trackcve.app/badge/CVE-2022-50285.svg)](https://trackcve.app/cve/CVE-2022-50285)

Record last updated 5 Nov 2026, 20:10 UTC.