CVE-2026-98373

Executive Summary

CVE-2026-98373 is a memory-management vulnerability in the Linux kernel's mm/hugetlb subsystem, specifically within the move_hugetlb_page_tables() function used during mremap() operations. When the source and destination page-table offsets differ, the destination address is advanced incorrectly, which can corrupt memory mappings and lead to a kernel panic. This flaw has been demonstrated to cause a kernel panic on x86-64 systems; while no public exploit code exists, the vulnerability class is memory corruption and could be leveraged for denial-of-service or privilege escalation under specific conditions. All Linux kernel versions containing the affected code are potentially impacted until the fix is applied.

Technical Analysis

The vulnerability resides in the Linux kernel's handling of huge pages during the mremap() system call. The function move_hugetlb_page_tables() is an optimization that advances the loop to the last entry in a page table when the source page table does not exist, either initially or after unsharing a PMD table. Normally, the common loop increment then steps to the first entry in the next page table. However, the flawed code advances both the source and destination addresses to the last entry in their respective page tables. This is incorrect: the destination address must be advanced only by the same delta as the source address.

If the source and destination offsets within their page tables differ, the destination address can be advanced too far, leading to incorrect page-table manipulation. This can result in memory corruption, mismatched mappings, or a kernel panic, as demonstrated by a reproducer on x86-64. The attack surface includes any process with the ability to perform mremap() on huge pages, which typically requires mapping huge pages and then remapping them. The vulnerability is a logic error (CWE-787: Out-of-bounds Write) in address arithmetic, but the exact out-of-bounds condition depends on the relationship between source and destination offsets.

The patch, as described, fixes the issue by advancing the destination address only by the source advance distance. No specific function names beyond move_hugetlb_page_tables() and mremap() are provided in the description.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the provided description.

1. Reconnaissance/target identification: An attacker identifies a Linux system with huge pages enabled and accessible to unprivileged users (e.g., via hugetlbfs or transparent huge pages). This is common in server, cloud, and container environments.

2. Triggering the flaw: The attacker crafts a program that calls mremap() on a memory region backed by huge pages, ensuring that the source and destination page-table offsets differ. This triggers the incorrect destination address advancement within move_hugetlb_page_tables(), corrupting the kernel's page-table state.

3. Payload/execution method: The specific payload depends on the attacker's goal. For denial-of-service, the corrupted state leads to a kernel panic, crashing the system. For privilege escalation, an attacker would need to shape the heap and page tables to gain control over a function pointer or page-table entry; however, the description only confirms a kernel panic, not privilege escalation.

4. Post-exploitation impact: A successful denial-of-service attack can render the system unavailable, disrupting services. If escalated to code execution, the attacker could gain kernel-level privileges, but this is not demonstrated. The immediate confirmed impact is a kernel panic.

Impact Assessment

The business impact includes system unavailability due to kernel panic, potentially causing downtime for critical services. The blast radius includes any Linux system with huge pages enabled and accessible to unprivileged users. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) suggests a local attacker with low privileges can cause high confidentiality, integrity, and availability impacts, though the public description only confirms availability (kernel panic). The attack complexity is low, and no user interaction is required. The lack of a patch increases risk for unpatched systems.

Detection Guidance

Sigma Rule

title: Linux Kernel Huge Page mremap Anomaly Detection
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2026-98373 via unusual mremap calls on huge pages
author: Valters IT
date: 2026-01-01
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        syscall: 'mremap'
        a0: '*'
    condition: selection
falsepositives:
    - Legitimate applications using mremap on huge pages
level: high

YARA Rule

rule CVE_2026_98373_Kernel_Panic_Trigger
{
    meta:
        description = "Detects binaries or scripts that may trigger CVE-2026-98373 via mremap on huge pages"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-98373"
    strings:
        $mremap = "mremap"
        $hugetlb = "hugetlb"
        $huge = "MAP_HUGETLB"
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98373 Linux Kernel mremap Exploit Attempt"; flow:to_server; content:"mremap"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "mremap" and process.args : "*hugetlb*"

Splunk SPL Query

index=linux sourcetype=auditd type=SYSCALL syscall=mremap
| stats count by host, process, user
| where count > 10

Wazuh OSSEC Rule

<rule id="100001" level="12">
    <decoded_as>auditd</decoded_as>
    <field name="syscall">mremap</field>
    <description>CVE-2026-98373: Possible mremap exploitation on huge pages</description>
    <group>linux,auditd,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict unprivileged access to huge pages by disabling MAP_HUGETLB for non-root users, or limit hugetlbfs mounts to trusted processes. Monitor for unusual mremap system calls on huge pages. Apply kernel live patching if available, but no official patch exists.

2. Patch/upgrade steps: No patch is currently available. Monitor Linux kernel stable and longterm branches for a fix commit referencing CVE-2026-98373. Once released, update the kernel to the patched version and reboot.

3. Long-term hardening: Follow Linux kernel security best practices: keep kernels updated, minimize unprivileged huge page usage, enable kernel address space layout randomization (KASLR), and deploy monitoring for kernel panics and unusual memory management system calls.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-98373
2. Linux Kernel Git Repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
3. CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. Linux Kernel Mailing List (LKML) discussions on mm/hugetlb: https://lore.kernel.org/linux-mm/
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/