CVE-2026-89758

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: skip non-present PMDs when queueing folios

Patch series "mm: handle device-private PMDs in walk callbacks", v3.

Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support

to PMD operations") a PMD may hold a device-private swap entry whenever an

HMM-based GPU driver migrates an anonymous THP folio to device memory via

migrate_vma_pages().

pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true

for any non-present, non-none huge PMD), so several MM walk callbacks that

used to assume present THP or migration entry are now reachable with a

device-private PMD. The results range from a VM_BUG_ON() firing on debug

kernels, to an oops on a bogus vmemmap dereference, to silently isolating

an unrelated live folio from LRU in the aliasing case.

This patch (of 3):

queue_folios_pmd() is called under pmd_trans_huge_lock(), whose

pmd_is_huge() check returns true for any non-pres

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References