Cloudanix VulnDB

CVE-2026-89758

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's memory handling can make systems using certain graphics cards crash or behave unpredictably when programs move memory around.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

queue_folios_pmd() under pmd_trans_huge_lock() passes non-present device-private PMDs to pmd_folio(), treating softleaf encoding as a PFN and returning a bogus folio pointer; this triggers VM_BUG_ON on debug kernels, oops on vmemmap dereference, or silent isolation of unrelated live folios from the LRU.

Why it matters to the business

Linux systems using HMM-based GPU drivers may experience kernel crashes, memory corruption, or unpredictable application behavior when userspace invokes mbind, migrate_pages, or set_mempolicy_home_node on ranges that have been migrated to device memory.

How an attack unfolds

An attacker with local unprivileged access triggers an HMM-based GPU driver to migrate an anonymous THP folio to device memory via migrate_vma_pages, leaving a device-private PMD; the attacker then calls mbind, migrate_pages, or set_mempolicy_home_node on that range to reach the vulnerable queue_folios_pmd path.

How to fix it

Apply the upstream fix that adds an early non-present PMD check in queue_folios_pmd before any folio lookup, matching the approach already used in queue_folios_pte_range; rebuild and deploy the updated kernel across all affected distributions.

How to confirm the fix worked

Confirm the presence of the non-present PMD guard in queue_folios_pmd, run targeted mbind/migrate_pages tests against device-private ranges on debug kernels, and verify absence of VM_BUG_ON or oops under those conditions.

Typical attack path

  1. Obtain local user access on a Linux system with an HMM-capable GPU driver
  2. Force migration of an anonymous THP to device-private memory
  3. Invoke mbind/migrate_pages/set_mempolicy_home_node on the affected range
  4. Trigger queue_folios_pmd under pmd_trans_huge_lock to dereference bogus folio

How to detect it

Review kernel logs for oops or VM_BUG_ON messages referencing queue_folios_pmd or pmd_folio after mbind/migrate_pages activity; correlate with HMM driver migration events in dmesg or ftrace.

What your security team should do

  • Prioritize kernel updates on GPU-accelerated Linux hosts within standard patch windows
  • Monitor for upstream stable backports of the three-patch series
  • Limit use of device-private migration in production until kernels are updated
  • Include memory-policy syscall coverage in fuzzing and regression suites

The record

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations") a PMD may hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(). pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true for any non-present, non-none huge PMD), so several MM walk callbacks that used to assume present THP or migration entry are now reachable with a device-private PMD. The results range from a VM_BUG_ON() firing on debug kernels, to an oops on a bogus vmemmap dereference, to silently isolating an unrelated live folio from LRU in the aliasing case. This patch (of 3): queue_folios_pmd() is called under pmd_trans_huge_lock(), whose pmd_is_huge() check returns true for any non-present, non-none PMD softleaf. Passing such a PMD to pmd_folio() treats the softleaf encoding as a hardware PFN and can return a bogus folio pointer. Mirror queue_folios_pte_range(): handle non-present entries before looking up a folio. Keep migration entries counted as failures, but skip other non-present PMDs such as device-private entries. Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(), leaving a device-private PMD. Userspace then calls mbind(), migrate_pages() or set_mempolicy_home_node() on that range.

Affected packages

Ecosystem Package Introduced Fixed