Executive brief
The Linux kernel's memory migration subsystem can crash or miscount memory pages when processing certain types of memory entries. During device memory migration operations, two memory-access functions (`pte_pfn` and `pte_dirty`) are called without validating whether the memory page table entry is actually present, leading to undefined behavior that may cause kernel panics or incorrect dirty-page accounting.
Technical details
The vulnerability is a logic error in the memory migration code (`mm/migrate_device.c`), specifically in the `migrate_vma_collect_pmd()` function. The functions `pte_pfn()` and `pte_dirty()` have undefined behavior when invoked on non-present page table entries (e.g., device-private memory entries). The code calls these functions without first checking `pte_present()`, potentially causing kernel crashes or incorrect memory accounting. An attacker with local access could trigger memory migration operations on device-private memory regions to exploit this. The fix guards both function calls with `pte_present()` checks. Patches are available in the Linux stable kernel tree as commit 63867c82d0c0c2d182016a32b1cc0103116b0ea5.
Affected products
- Linux Linux kernel multiple versions through 2026 (based on stable tree releases)
Timeline
- 2026-08-28: disclosed: Published in NVD
- 2026-08-23: patched: Patch merged into stable kernel tree by Greg Kroah-Hartman