In the Linux kernel, the following vulnerability has been resolved:
mm,hugetlb: take hugetlblock before decrementing h->resvhuge_pages
The h->*hugepages counters are protected by the hugetlblock, but allochuge_page has a corner case where it can decrement the counter outside of the lock.
This could lead to a corrupted value of h->resvhugepages, which we have observed on our systems.
Take the hugetlblock before decrementing h->resvhuge_pages to avoid a potential race.