CVE-2026-89758

Received Received - Intake

Memory Corruption in Linux Kernel mmap Handling

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations") a PMD may hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(). pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true for any non-present, non-none huge PMD), so several MM walk callbacks that used to assume present THP or migration entry are now reachable with a device-private PMD. The results range from a VM_BUG_ON() firing on debug kernels, to an oops on a bogus vmemmap dereference, to silently isolating an unrelated live folio from LRU in the aliasing case. This patch (of 3): queue_folios_pmd() is called under pmd_trans_huge_lock(), whose pmd_is_huge() check returns true for any non-present, non-none PMD softleaf. Passing such a PMD to pmd_folio() treats the softleaf encoding as a hardware PFN and can return a bogus folio pointer. Mirror queue_folios_pte_range(): handle non-present entries before looking up a folio. Keep migration entries counted as failures, but skip other non-present PMDs such as device-private entries. Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(), leaving a device-private PMD. Userspace then calls mbind(), migrate_pages() or set_mempolicy_home_node() on that range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89758

EUVD

EUVD-2026-76670

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of non-present PMDs (Page Middle Directories) during memory operations. When an HMM-based GPU driver migrates memory, it can leave a device-private PMD that is not properly skipped by functions like queue_folios_pmd(). This leads to potential issues such as VM_BUG_ON() failures, kernel oops, or incorrect memory isolation.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and requires kernel-level detection. There are no standard network or system commands to directly detect it. Monitoring for kernel oops, VM_BUG_ON() triggers, or bogus vmemmap dereferences in system logs may indicate exploitation. Kernel developers recommend checking for device-private PMD entries in memory mappings using kernel debugging tools like crash or ftrace.

Impact Analysis

The vulnerability can cause system instability, including kernel crashes or unexpected behavior when memory operations are performed on affected ranges. Users relying on GPU drivers with HMM support may experience crashes or data corruption during memory migration tasks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to system instability or crashes under specific conditions involving GPU memory migration. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch from the series 'mm: handle device-private PMDs in walk callbacks' to resolve the issue. If patching is not immediately possible, avoid using HMM-based GPU drivers that migrate anonymous THP folios to device memory. Restrict access to mbind(), migrate_pages(), and set_mempolicy_home_node() system calls for untrusted users until patched.

Hi! I’m here to help you understand CVE-2026-89758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70