Junglewise Threat Intelligence

CVE-2026-90391: Linux kernel test_hmm infinite loop in dmirror_fault

CVE-2026-90391 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's test_hmm module contains a logic error in the dmirror_fault() function that can cause infinite loops when a mirrored memory process exits. The function incorrectly reports success instead of failure when unable to fault in pages, causing calling code to retry indefinitely without progress. This affects the test/development component and could lead to system hangs or denial of service in testing environments.

Technical details

The vulnerability is a logic error in lib/test_hmm.c where the dmirror_fault() function returns 0 (success) when mmget_not_zero() fails, indicating the mirrored mm has exited. This incorrect return value causes the caller's retry loop (in dmirror_read() and dmirror_write()) to repeatedly attempt the same fault operation, hitting -ENOENT and looping forever without making progress. The fix changes the return value from 0 to -EFAULT when the mirrored mm is no longer accessible. This is a test module vulnerability affecting kernel development/testing workflows, with no direct impact on production systems. The patch is upstream and available in the Linux kernel repository.

Affected products

  • Linux Linux kernel Affects multiple versions via lib/test_hmm.c (testing module)

Timeline

  • 2026-09-17: disclosed
  • 2026-07-01: patched: Upstream patch commit 6a8024511ddf4877435c34fb3d6028aa8e590649

References

Related threats