CVE-2026-89967

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: avoid out-of-bounds writes for compound folios

migrate_device_range() and migrate_device_pfns() clear the entries

following a compound folio so that the PFN arrays retain their

page-granular representation.

If a compound folio extends beyond the end of the caller-provided range,

the loops clear all following folio entries without limiting them to the

number of slots remaining in the npages-sized array, causing an

out-of-bounds write.

Do not proceed with a compound folio if its page-granular representation

does not fit entirely in the remaining PFN array. If this happens, drop

any reference and lock acquired for the folio, clear the remaining

entries, and stop collecting.

Observed with a KASAN x86 QEMU kernel using the HMM migrate_anon_huge_zero

selftest. Closing /dev/hmm_dmirror0 after migrating an anonymous huge

page to device memory exercises:

dmirror_fops_release()

-> dmirror_device_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References