Executive brief
The Linux kernel's device memory migration functions contain a buffer overflow vulnerability when handling large memory pages (compound folios). An attacker or unprivileged user can trigger this flaw during memory migration operations, causing kernel memory corruption that could lead to a system crash or privilege escalation. This affects any system performing device memory migration, particularly with huge page support enabled.
Technical details
The vulnerability exists in the mm/migrate_device.c module, specifically in the migrate_device_range() and migrate_device_pfns() functions. These functions fail to validate that a compound folio (a large, multi-page memory structure) fits entirely within the caller-provided PFN (page frame number) array before clearing entries beyond its boundary. When a compound folio extends past the array's end, the code writes to memory outside the allocated array, causing an out-of-bounds write. The flaw can be triggered locally through device memory migration operations, such as closing /dev/hmm_dmirror0 after huge page migration. A patch was released that adds bounds checking to prevent processing a compound folio unless its entire page-granular representation fits in the remaining array space.
Affected products
- Linux Linux kernel Affected by changes introduced in commit a30b48bf1b24 (mm/migrate_device: implement THP migration of zone device pages); patched upstream in commit dc41e961a269f2ca4196e669d6d8e05480899cd4
Timeline
- 2026-09-16: disclosed: CVE-2026-89967 published on NVD
- 2026-09-01: patched: Upstream patch committed by Andrew Morton
- 2026-08-17: other: Fix authored by Hui Su