CVE-2026-93284 (GCVE-0-2026-93284)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:02 – Updated: 2026-09-25 05:10
VLAI
Title
drm/pagemap: dma-unmap pages before handling migration errors
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page information if it is called afterward. Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() so the pages array remains valid during DMA unmapping.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f86ad0ed620cb3c91ec7d5468e93ac68d727539d , < e4331c6644db85bc6ceb470bd84bcf371b6dbfa6 (git)
Affected: f86ad0ed620cb3c91ec7d5468e93ac68d727539d , < 9e6372ec2a3990662ae0a67f56ac0aee19848d5b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_pagemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e4331c6644db85bc6ceb470bd84bcf371b6dbfa6",
              "status": "affected",
              "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d",
              "versionType": "git"
            },
            {
              "lessThan": "9e6372ec2a3990662ae0a67f56ac0aee19848d5b",
              "status": "affected",
              "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_pagemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: dma-unmap pages before handling migration errors\n\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\n\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Local ioctl/fault path only: DRM_IOCTL_XE_VM_CREATE (FAULT_MODE) and DRM_IOCTL_XE_VM_BIND (CPU_ADDR_MIRROR) on /dev/dri/renderD* migrate the caller\u0027s anonymous range to VRAM, then do_swap_page() invokes drm_pagemap_migrate_to_ram() -\u003e __drm_pagemap_migrate_to_ram(), or xe_bo_move() calls xe_svm_bo_evict() -\u003e drm_pagemap_evict_to_ram(). No remote protocol byte reaches those functions.\nAC:L - The attacker creates the SVM range, migrates it to VRAM, and CPU-faults or TTM-evicts it. After drm_pagemap_migrate_map_system_pages() has dma_map_page()\u0027d dest folios, they force err_finalize by exhausting gt-\u003eusm.bb_pool so xe_svm_copy_to_ram()/xe_bb_new() returns -ENOMEM, or by fragmenting IOVA so dma_iova_try_alloc() fails and a later dma_map_page() returns -EFAULT. No victim timing.\nPR:L - DRM_IOCTL_XE_VM_CREATE and DRM_IOCTL_XE_VM_BIND are DRM_RENDER_ALLOW; xe_vm_create_ioctl() performs no capable() or DRM-master check. An unprivileged local user with typical render/video-group access to /dev/dri/renderD* on an Intel Xe discrete GPU (CONFIG_DRM_XE_PAGEMAP defaults to y) can create a fault-mode VM and reach the patched functions.\nUI:N - The attacking process opens the render node, creates its own fault-mode VM, CPU_ADDR_MIRROR-binds its anonymous mapping, prefetches or GPU-faults it into VRAM, then CPU-accesses or forces TTM eviction. No other user must mount a filesystem or open a file.\nS:C - On err_finalize, drm_pagemap_migration_unlock_put_pages() folio_put()s the destination RAM folios and zeros migrate_pfn, so drm_pagemap_migrate_unmap_pages() sees a NULL page and skips dma_unmap_page(). Those IOMMU PTEs remain aimed at pages already returned to the buddy allocator, which is an IOMMU/DMA isolation bypass.\nC:H - Destination folios from drm_pagemap_migrate_populate_ram_pfn() are put while still dma_map_page()\u0027d. Recycled host pages stay IOMMU-reachable through the leaked translation, so later DMA can disclose their new kernel or cross-process contents rather than a bounded pointer leak.\nI:H - The leaked mappings are DMA_FROM_DEVICE (Xe copy-from-VRAM via xe_svm_copy_to_ram()). After folio_put(), a GPU/IOMMU transaction through those IOVAs writes into whatever reused the physical pages, an arbitrary physical write through the IOMMU rather than a bounded corruption.\nA:H - Each failed __drm_pagemap_migrate_to_ram()/drm_pagemap_evict_to_ram() leaks that range\u0027s dma_map_page() IOVAs; the attacker loops CPU faults after inducing xe_bb_new() or map errors. Unbounded IOVA growth wedges later maps, and DMA into buddy-reused pages oopses or panics, not a mere slowdown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:10:00.488Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b"
        }
      ],
      "title": "drm/pagemap: dma-unmap pages before handling migration errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93284",
    "datePublished": "2026-09-24T16:02:08.527Z",
    "dateReserved": "2026-09-17T16:02:15.099Z",
    "dateUpdated": "2026-09-25T05:10:00.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93284",
      "date": "2026-09-28",
      "epss": "0.0012",
      "percentile": "0.0165"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_pagemap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e4331c6644db85bc6ceb470bd84bcf371b6dbfa6",
                    "status": "affected",
                    "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e6372ec2a3990662ae0a67f56ac0aee19848d5b",
                    "status": "affected",
                    "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_pagemap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: dma-unmap pages before handling migration errors\n\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\n\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping."
          }
        ],
        "id": "CVE-2026-93284",
        "lastModified": "2026-09-25T05:17:01.900",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:09.587",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-28T15:19:58+00:00",
      "cve": "CVE-2026-93284",
      "id": "CVE-2026-93284",
      "initial_release_date": "2026-09-24T00:00:00+00:00",
      "product_status:known_affected": "183",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/pagemap: dma-unmap pages before handling migration errors",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93284.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-25T23:49:15Z",
      "cve": "CVE-2026-93284",
      "id": "CVE-2026-93284",
      "initial_release_date": "2026-09-24T23:48:19Z",
      "product_status:known_affected": "12",
      "product_status:known_not_affected": "335",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93284",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93284.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.