Cloudanix VulnDB

CVE-2026-80686

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug could make systems crash during certain memory-moving operations involving specialized device memory.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Calling pte_pfn() and pte_dirty() on non-present PTEs in migrate_vma_collect_pmd() triggers undefined behavior, risking kernel crashes or incorrect dirty folio accounting for device-private entries.

Why it matters to the business

Linux systems performing device memory migration may experience unexpected crashes or data-accounting errors, with low immediate risk given absent exploitation and stable low exploit probability.

How an attack unfolds

An attacker would need to force migrate_vma_collect_pmd() to process non-present device-private PTEs without presence guards, causing the unsafe pte calls; no public exploitation or threat-actor activity observed.

How to fix it

Apply the upstream kernel commit adding pte_present() checks before pte_pfn() and pte_dirty() calls in migrate_vma_collect_pmd(); rebuild and deploy the fixed kernel.

How to confirm the fix worked

Inspect the migrate_vma_collect_pmd() implementation for surrounding pte_present() guards; confirm the patched kernel version is running via uname or package manager.

Typical attack path

  1. Trigger device-private memory migration paths
  2. Supply non-present PTE entries to migrate_vma_collect_pmd()
  3. Invoke pte_pfn() or pte_dirty() on those entries to induce undefined behavior or crash

How to detect it

Review kernel logs and dmesg for oops/panic entries referencing migrate_vma_collect_pmd, pte_pfn, or pte_dirty; correlate with device migration events.

What your security team should do

  • Prioritize kernel updates on systems using device-private migration
  • Monitor for related kernel oops in production
  • Test migration workloads after patching to verify stability

The record

In the Linux kernel, the following vulnerability has been resolved: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from pte_pfn() or incorrect dirty folio accounting from pte_dirty(). Fix both by guarding with pte_present() checks.

Affected packages

Ecosystem Package Introduced Fixed