Executive brief
A vulnerability was identified in the Linux kernel's memory management system, specifically how it handles memory associated with hardware devices. When the system releases this memory, it was incorrectly attempting to access the memory's metadata after it had already been freed, which could lead to system instability or crashes. This issue primarily affects system reliability and could potentially be exploited to cause a denial-of-service.
Technical details
A use-after-free (UAF) race condition exists in mm/memremap.c within the free_zone_device_folio function. The root cause is the kernel attempting to access folio->pgmap to extract a reference pointer after the folio has been released via pgmap->ops->folio_free(folio). Because a driver can immediately reallocate the folio with a different configuration after it is freed, the subsequent access is unsafe. An attacker with local access could potentially exploit this race condition to cause a kernel oops or memory corruption. The fix involves using a local stack variable for the pgmap reference instead of accessing the folio structure after the free call.
Affected products
- Linux Linux Kernel Fixed in commits 3992898 and 85be0a2
Timeline
- 2026-04-18: patched: Initial fix committed to mainline kernel
- 2026-06-08: disclosed: CVE published to NVD