CVE-2026-72173
Description
A flaw was found in the Linux kernel's memory management unit (MMU). The pagemap_pmd_range_thp() function incorrectly issued a warning when encountering certain non-present Page Middle Directory (PMD) entries. This issue arose because an assertion related to migration-only softleaf entries became outdated after the introduction of device-private PMD entries. While not directly exploitable for arbitrary code execution or privilege escalation, this flaw could lead to misleading diagnostic information within the kernel.
Statement
A low impact flaw was found in the Linux kernel's memory management code in fs/proc/task_mmu.c. The pagemap_pmd_range_thp() function contained a stale warning that fired whenever it encountered a non-present Page Middle Directory (PMD) entry that was not a migration entry; this assertion became outdated once device-private PMD entries (used with HMM/device memory) were introduced. A local user able to inspect the pagemap of a process whose address space contains such device-private PMD mappings could trigger this kernel warning, producing misleading diagnostic output, and on systems configured with panic_on_warn it could turn into a kernel panic (denial of service). No use-after-free, out-of-bounds access, or privilege escalation is indicated. Red Hat Enterprise Linux 7, 8, 9, and 10 (including the kernel-rt variants) and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those releases; the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope. Red Hat assesses the impact of this flaw as Low, which is lower than the Moderate severity implied by the CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, because the issue is warning-driven, requires the presence of device-private PMD mappings, and does not affect confidentiality or integrity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
