CVE-2026-93217
Received Received - Intake

Race Condition in Linux Kernel Memory Management

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvise_cold_or_pageout_pte_range() takes pmd_trans_huge_lock(), whose pmd_is_huge() check returns true for a device-private PMD. The subsequent !pmd_present() branch has a VM_BUG_ON() asserting migration is the only allowed non-present case; a device-private PMD trips it. Skip device-private PMDs in that non-present branch and continue to huge_unlock before calling pmd_folio(). Downgrade the check to VM_WARN_ON_ONCE() so an unexpected PMD softleaf logs a warning rather than panicking. Drop the thp_migration_supported() guard: it expands to IS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both pmd_is_migration_entry() and pmd_is_device_private_entry() already return false when that config is not selected, so the guard suppresses only the case where the warning would already be silent. Potential trigger: an HMM-based GPU driver races with madvise(MADV_COLD)/MADV_PAGEOUT: pmd_trans_huge(*pmd) reads true, then migrate_vma_pages() flips the PMD to a device-private entry before the PMD lock is acquired.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93217
EUVD
EUVD-2026-85946

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where madvise_cold_or_pageout_pte_range() incorrectly handles device-private PMDs. The function uses pmd_trans_huge_lock() which treats device-private PMDs as huge pages. When pmd_is_huge() returns true for these PMDs, the code enters a branch that expects only migration entries to be non-present. Device-private PMDs trigger a VM_BUG_ON() assertion, causing a kernel panic. The fix skips device-private PMDs in this branch and downgrades the check to a warning.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level detection. Monitor kernel logs for VM_BUG_ON or VM_WARN_ON_ONCE warnings related to madvise_cold_or_pageout_pte_range or PMD handling. Check for crashes or panics during madvise(MADV_COLD) or MADV_PAGEOUT operations.

Impact Analysis

If exploited, this vulnerability could cause a kernel panic, leading to system crashes or denial of service. It requires a race condition between an HMM-based GPU driver and madvise(MADV_COLD)/MADV_PAGEOUT operations. Successful exploitation depends on specific kernel configurations and driver interactions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to system instability or crashes under specific race conditions involving GPU drivers and memory operations. Compliance impacts would only occur if such instability caused data corruption or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest kernel patches or updates that resolve this issue. If using a GPU driver with HMM support, ensure it is updated to a version compatible with the patched kernel. Avoid using madvise(MADV_COLD) or MADV_PAGEOUT on systems with HMM-based GPU drivers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart