GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89758 (GCVE-0-2026-89758)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:47 – Updated: 2026-09-13 06:34
VLAI
Title
mm/mempolicy: skip non-present PMDs when queueing folios
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations") a PMD may hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(). pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true for any non-present, non-none huge PMD), so several MM walk callbacks that used to assume present THP or migration entry are now reachable with a device-private PMD. The results range from a VM_BUG_ON() firing on debug kernels, to an oops on a bogus vmemmap dereference, to silently isolating an unrelated live folio from LRU in the aliasing case. This patch (of 3): queue_folios_pmd() is called under pmd_trans_huge_lock(), whose pmd_is_huge() check returns true for any non-present, non-none PMD softleaf. Passing such a PMD to pmd_folio() treats the softleaf encoding as a hardware PFN and can return a bogus folio pointer. Mirror queue_folios_pte_range(): handle non-present entries before looking up a folio. Keep migration entries counted as failures, but skip other non-present PMDs such as device-private entries. Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(), leaving a device-private PMD. Userspace then calls mbind(), migrate_pages() or set_mempolicy_home_node() on that range.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 368076f52ebeecd33e10a9f80905d7508b6b6149 , < 3d927093b2add7ced588a926c3dc5d7a83f18596 (git)
Affected: 368076f52ebeecd33e10a9f80905d7508b6b6149 , < 2858b4027f491e6fdb8ee2d8923798b619bf2791 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/mempolicy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d927093b2add7ced588a926c3dc5d7a83f18596",
              "status": "affected",
              "version": "368076f52ebeecd33e10a9f80905d7508b6b6149",
              "versionType": "git"
            },
            {
              "lessThan": "2858b4027f491e6fdb8ee2d8923798b619bf2791",
              "status": "affected",
              "version": "368076f52ebeecd33e10a9f80905d7508b6b6149",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/mempolicy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: skip non-present PMDs when queueing folios\n\nPatch series \"mm: handle device-private PMDs in walk callbacks\", v3.\n\nSince commit 368076f52ebe (\"mm/huge_memory: add device-private THP support\nto PMD operations\") a PMD may hold a device-private swap entry whenever an\nHMM-based GPU driver migrates an anonymous THP folio to device memory via\nmigrate_vma_pages().\n\npmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true\nfor any non-present, non-none huge PMD), so several MM walk callbacks that\nused to assume present THP or migration entry are now reachable with a\ndevice-private PMD.  The results range from a VM_BUG_ON() firing on debug\nkernels, to an oops on a bogus vmemmap dereference, to silently isolating\nan unrelated live folio from LRU in the aliasing case.\n\n\nThis patch (of 3):\n\nqueue_folios_pmd() is called under pmd_trans_huge_lock(), whose\npmd_is_huge() check returns true for any non-present, non-none PMD\nsoftleaf.  Passing such a PMD to pmd_folio() treats the softleaf encoding\nas a hardware PFN and can return a bogus folio pointer.\n\nMirror queue_folios_pte_range(): handle non-present entries before looking\nup a folio.  Keep migration entries counted as failures, but skip other\nnon-present PMDs such as device-private entries.\n\nPotential trigger: an HMM-based GPU driver migrates an anonymous THP folio\nto device memory via migrate_vma_pages(), leaving a device-private PMD. \nUserspace then calls mbind(), migrate_pages() or set_mempolicy_home_node()\non that range."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - queue_folios_pmd() is reached only from local mbind() and migrate_pages() via do_mbind()/do_migrate_pages() -\u003e queue_pages_range() -\u003e walk_page_range(); it is not a network, Bluetooth, or USB packet path.\nAC:L - An attacker with GPU/HMM access can deterministically migrate an anonymous THP to device memory (leaving a device-private PMD) and then call mbind()/migrate_pages() on that range; no victim state or attacker-uncontrollable race is required.\nPR:L - mbind() and self migrate_pages() are unprivileged; MPOL_MF_MOVE needs no capability. Device-private THP is created through ordinary DRM render-node/HMM usage (AMD KFD, Intel Xe, nouveau), not init-namespace root.\nUI:N - The attacker creates the device-private THP mapping and issues mbind() or migrate_pages() entirely in their own process; no other user must mount, open, or otherwise act.\nS:U - Impact is host-kernel MM corruption (bogus folio lookup and LRU isolation) within the same security authority; it is not a VM guest-to-host escape, IOMMU bypass, or sandbox breakout.\nC:H - pmd_folio() treats a device-private PMD as a present THP and returns a bogus folio; aliasing isolates and migrates an unrelated live folio, a memory-corruption primitive usable for arbitrary kernel/user memory disclosure.\nI:H - The same bogus folio can be isolated from the LRU and handed to migrate_pages(), silently moving an unrelated live folio and enabling use-after-free, page-table corruption, and control-flow hijack.\nA:H - A bogus vmemmap dereference oopses the kernel, debug builds hit VM_BUG_ON, and isolating or migrating the wrong folio can panic or hang the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:34:02.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d927093b2add7ced588a926c3dc5d7a83f18596"
        },
        {
          "url": "https://git.kernel.org/stable/c/2858b4027f491e6fdb8ee2d8923798b619bf2791"
        }
      ],
      "title": "mm/mempolicy: skip non-present PMDs when queueing folios",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89758",
    "datePublished": "2026-09-11T19:47:00.562Z",
    "dateReserved": "2026-09-11T19:38:34.763Z",
    "dateUpdated": "2026-09-13T06:34:02.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89758",
      "date": "2026-09-15",
      "epss": "0.00143",
      "percentile": "0.03974"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89758\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:06.880\",\"lastModified\":\"2026-09-13T07:17:40.190\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/mempolicy: skip non-present PMDs when queueing folios\\n\\nPatch series \\\"mm: handle device-private PMDs in walk callbacks\\\", v3.\\n\\nSince commit 368076f52ebe (\\\"mm/huge_memory: add device-private THP support\\nto PMD operations\\\") a PMD may hold a device-private swap entry whenever an\\nHMM-based GPU driver migrates an anonymous THP folio to device memory via\\nmigrate_vma_pages().\\n\\npmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true\\nfor any non-present, non-none huge PMD), so several MM walk callbacks that\\nused to assume present THP or migration entry are now reachable with a\\ndevice-private PMD.  The results range from a VM_BUG_ON() firing on debug\\nkernels, to an oops on a bogus vmemmap dereference, to silently isolating\\nan unrelated live folio from LRU in the aliasing case.\\n\\n\\nThis patch (of 3):\\n\\nqueue_folios_pmd() is called under pmd_trans_huge_lock(), whose\\npmd_is_huge() check returns true for any non-present, non-none PMD\\nsoftleaf.  Passing such a PMD to pmd_folio() treats the softleaf encoding\\nas a hardware PFN and can return a bogus folio pointer.\\n\\nMirror queue_folios_pte_range(): handle non-present entries before looking\\nup a folio.  Keep migration entries counted as failures, but skip other\\nnon-present PMDs such as device-private entries.\\n\\nPotential trigger: an HMM-based GPU driver migrates an anonymous THP folio\\nto device memory via migrate_vma_pages(), leaving a device-private PMD. \\nUserspace then calls mbind(), migrate_pages() or set_mempolicy_home_node()\\non that range.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/mempolicy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"368076f52ebeecd33e10a9f80905d7508b6b6149\",\"lessThan\":\"3d927093b2add7ced588a926c3dc5d7a83f18596\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"368076f52ebeecd33e10a9f80905d7508b6b6149\",\"lessThan\":\"2858b4027f491e6fdb8ee2d8923798b619bf2791\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/mempolicy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2858b4027f491e6fdb8ee2d8923798b619bf2791\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3d927093b2add7ced588a926c3dc5d7a83f18596\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:52:49+00:00",
      "cve": "CVE-2026-89758",
      "id": "CVE-2026-89758",
      "initial_release_date": "2026-09-11T19:47:00.562000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to improper handling of device-private PMDs in memory management",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89758.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:56:22Z",
      "cve": "CVE-2026-89758",
      "id": "CVE-2026-89758",
      "initial_release_date": "2026-09-12T16:22:05Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89758",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89758.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.