Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-11T00:00:00 kernel: mm/mempolicy: skip non-present PMDs when queueing folios 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-824

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations") a PMD may hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(). pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true for any non-present, non-none huge PMD), so several MM walk callbacks that used to assume present THP or migration entry are now reachable with a device-private PMD. The results range from a VM_BUG_ON() firing on debug kernels, to an oops on a bogus vmemmap dereference, to silently isolating an unrelated live folio from LRU in the aliasing case. This patch (of 3): queue_folios_pmd() is called under pmd_trans_huge_lock(), whose pmd_is_huge() check returns true for any non-present, non-none PMD softleaf. Passing such a PMD to pmd_folio() treats the softleaf encoding as a hardware PFN and can return a bogus folio pointer. Mirror queue_folios_pte_range(): handle non-present entries before looking up a folio. Keep migration entries counted as failures, but skip other non-present PMDs such as device-private entries. Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(), leaving a device-private PMD. Userspace then calls mbind(), migrate_pages() or set_mempolicy_home_node() on that range.

A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit (GPU) driver migrates a Transparent Huge Page (THP) to device memory, it can leave a device-private Page Middle Directory (PMD) entry. If a user-space application then attempts to manage this memory range, the kernel may incorrectly process the non-present PMD, leading to a system crash. This vulnerability could allow a local attacker to cause a Denial of Service (DoS).

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 10 Not affected kernel-rt Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89758 https://nvd.nist.gov/vuln/detail/CVE-2026-89758 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89758.mbox