Executive brief
A memory management vulnerability in the Linux kernel's DRM graphics subsystem can cause system instability or data corruption when allocating large memory blocks for GPU operations. The bug occurs in page allocation routines that fail to properly handle memory pressure conditions and incorrectly access freed memory, potentially allowing an attacker with local access to trigger a denial of service or corrupt kernel memory.
Technical details
The vulnerability exists in drm_pagemap_migrate_populate_ram_pfn() in the DRM subsystem and consists of two related flaws: (1) higher-order folio allocations lack __GFP_NOWARN and have no fallback to order-0 allocations on failure, causing kernel log spam and incomplete population under memory pressure, and (2) the error path computes folio order from a page reference after put_page() has already dropped the reference, creating a use-after-free condition if that was the last reference. Additionally, the source page array population logic relies on per-folio ordering which breaks when destination pages are demoted to order-0, causing incomplete copies. A local attacker or resource-constrained condition can trigger these paths through GPU memory operations, leading to memory corruption or denial of service. Patches addressing the fallback logic, use-after-free ordering, and source page array handling are included in the fix.
Affected products
- Linux Linux kernel Unspecified (DRM subsystem, drm/pagemap component)
Timeline
- 2026-09-16: disclosed