VulnerabilityPublished 7 Oct 2026Updated 21 Oct 2026

CVE-2026-98373: Linux kernel · mm/hugetlb: preserve mremap address delta when skipping page tables

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in cf73ef2a761df9329af116c905a7a94b317921e4 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cf73ef2a761df9329af116c905a7a94b317921e4, 850cc4a84b36a0062dcd0391acd2450e20ab0767, 480a39b0a12c977ed6e755f3d12a23424c57d11f +2

Exploitation evidence

Disclosed: evidence found.
CVE published 7 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e95a9851787bbb3cd4deb40fe8bab03f731852d1, < cf73ef2a761df9329af116c905a7a94b317921e4	Fixed in cf73ef2a761df9329af116c905a7a94b317921e4
LinuxLinux	Affected ≥ e95a9851787bbb3cd4deb40fe8bab03f731852d1, < 850cc4a84b36a0062dcd0391acd2450e20ab0767	Fixed in 850cc4a84b36a0062dcd0391acd2450e20ab0767
LinuxLinux	Affected ≥ e95a9851787bbb3cd4deb40fe8bab03f731852d1, < 480a39b0a12c977ed6e755f3d12a23424c57d11f	Fixed in 480a39b0a12c977ed6e755f3d12a23424c57d11f
LinuxLinux	Affected ≥ e95a9851787bbb3cd4deb40fe8bab03f731852d1, < 9bdad082d44bdcf93716973dcba6be77e8a06e7b	Fixed in 9bdad082d44bdcf93716973dcba6be77e8a06e7b
LinuxLinux	Affected ≥ e95a9851787bbb3cd4deb40fe8bab03f731852d1, < 7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff	Fixed in 7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff
LinuxLinux	Affected =6.0	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables move_hugetlb_page_tables() optimizes mremap() by advancing to the last entry in the page table when the source page table does not exist, either initially or after unsharing a PMD table. The common loop increment then steps to the first entry in the next page table. However, the code advances both the source and destination addresses to the last entries in their respective page tables, which is wrong. The destination address must be advanced only by the same amount as the source address. If the source and destination offsets within their page tables differ, the destination address can be advanced too far, causing follow-up issues. Fix this by advancing the destination address by the source advance distance. With a reproducer, we were able to trigger a kernel panic on x86-64. With this fix in place, we can no longer reproduce the issue.

References

Community reviews

Loading reviews…