Executive brief
A vulnerability was identified in the Linux kernel's HMM (Heterogeneous Memory Management) testing component. This flaw can cause a system crash (kernel panic) when certain memory-intensive operations or system errors occur, such as during a program crash (coredump). While primarily affecting testing environments, it represents a stability risk to the operating system.
Technical details
A use-after-free vulnerability exists in lib/test_hmm.c within the Linux kernel. When dmirror_fops_release() is called, it frees the dmirror structure without first migrating device private pages back to system memory. This leaves pages with a dangling zone_device_data pointer. If a subsequent fault occurs on these pages (for example, during a coredump), the dmirror_devmem_fault() callback dereferences the stale pointer, resulting in a kernel panic. The fix involves calling dmirror_device_evict_chunk() during the release process to ensure all pages are migrated before the structure is freed.
Affected products
- Linux Linux kernel Fixed in 6.9 and various stable branches
Timeline
- 2026-04-28: patched: Initial patch authored by Alistair Popple
- 2026-06-08: disclosed: CVE-2026-46280 published
References
- https://git.kernel.org/stable/c/38f113f81d3f0adc658a4475dd3ecaec985e21d3
- https://git.kernel.org/stable/c/5846715b6382dd4c6a69b35a56ca6115d33bc2a0
- https://git.kernel.org/stable/c/744dd97752ef1076a8d8672bb0d8aa2c7abc1144
- https://git.kernel.org/stable/c/9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1
- https://git.kernel.org/stable/c/bf477abd448c76bb8ea51c9b4f63a3a17c4b6239