CVE-2026-63953
Received Received - Intake

Memory Leak in Linux Kernel mm/migrate_device

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due to a PMD check failure, the pgtable allocated earlier via pte_alloc_one() is never freed, causing a memory leak. Added free_abort label to release the pgtable in error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63953
EUVD
EUVD-2026-45726

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Linux kernel. When a function called migrate_vma_insert_huge_pmd_page fails a check, it skips freeing a page table that was previously allocated. This causes the system to lose track of that memory, leading to a gradual reduction in available memory over time.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a memory leak in the mm/migrate_device subsystem. Detection requires checking kernel logs for memory allocation failures or leaks related to migrate_vma_insert_huge_pmd_page. Use commands like dmesg | grep -i migrate or journalctl -k | grep -i migrate to inspect kernel logs for errors.

Impact Analysis

The memory leak could cause system performance to degrade as available memory decreases. In severe cases, it might lead to crashes or instability if the system runs out of memory. Servers or devices running affected Linux kernel versions could experience these issues.

Compliance Impact

This vulnerability causes a memory leak in the Linux kernel's mm/migrate_device component due to a pgtable not being freed in an error path. It does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level system resource issue rather than a data protection or privacy violation.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this vulnerability. Monitor kernel logs for memory leaks or errors related to migrate_vma_insert_huge_pmd_page. If affected, reboot the system after applying patches to ensure the updated kernel is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63953. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart