---
id: CVE-2022-50285
title: 'mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages

  The h->*_huge_pages counters are protected by the hugetlb_lock, but
  alloc_huge_page has a corner c…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    3e50a07b6a5fcd39df1534d3fdaca4292a65efe6
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    629c986e19fe9481227c7cdfd9a105bbc104d245
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    2b35432d324898ec41beb27031d2a1a864a4d40e
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    11993652d0b49e27272db0a37aa828d8a3a4b92b
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    568e3812b1778b4c0c229649b59977d88f400ece
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    112a005d1ded04a4b41b6d01833cc0bda90625cc
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    c828fab903725279aa9dc6ae3d44bb7e4778f92c
  - >-
    Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 <
    12df140f0bdfae5dcfc81800970dd7f6f632e00c
  - Linux 3f5fae4d1a3189d95b02b4b45e1218df147122bc
  - Linux >= 4.3.6 < 4.4
  - Linux 4.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:08:59.508628Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:33.178Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50285'
references:
  - url: 'https://git.kernel.org/stable/c/3e50a07b6a5fcd39df1534d3fdaca4292a65efe6'
  - url: 'https://git.kernel.org/stable/c/629c986e19fe9481227c7cdfd9a105bbc104d245'
  - url: 'https://git.kernel.org/stable/c/2b35432d324898ec41beb27031d2a1a864a4d40e'
  - url: 'https://git.kernel.org/stable/c/11993652d0b49e27272db0a37aa828d8a3a4b92b'
  - url: 'https://git.kernel.org/stable/c/568e3812b1778b4c0c229649b59977d88f400ece'
  - url: 'https://git.kernel.org/stable/c/112a005d1ded04a4b41b6d01833cc0bda90625cc'
  - url: 'https://git.kernel.org/stable/c/c828fab903725279aa9dc6ae3d44bb7e4778f92c'
  - url: 'https://git.kernel.org/stable/c/12df140f0bdfae5dcfc81800970dd7f6f632e00c'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05164
ingestedAt: '2026-11-05T22:38:31.719Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages

The h->*_huge_pages counters are protected by the hugetlb_lock, but
alloc_huge_page has a corner case where it can decrement the counter
outside of the lock.

This could lead to a corrupted value of h->resv_huge_pages, which we have
observed on our systems.

Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a
potential race.

## Affected

- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 3e50a07b6a5fcd39df1534d3fdaca4292a65efe6`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 629c986e19fe9481227c7cdfd9a105bbc104d245`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 2b35432d324898ec41beb27031d2a1a864a4d40e`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 11993652d0b49e27272db0a37aa828d8a3a4b92b`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 568e3812b1778b4c0c229649b59977d88f400ece`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 112a005d1ded04a4b41b6d01833cc0bda90625cc`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < c828fab903725279aa9dc6ae3d44bb7e4778f92c`
- `Linux >= a88c769548047b21f76fd71e04b6a3300ff17160 < 12df140f0bdfae5dcfc81800970dd7f6f632e00c`
- `Linux 3f5fae4d1a3189d95b02b4b45e1218df147122bc`
- `Linux >= 4.3.6 < 4.4`
- `Linux 4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.