Executive brief
The Linux kernel's test_hmm module contains a logic error in the dmirror_fault() function that can cause infinite loops when a mirrored memory process exits. The function incorrectly reports success instead of failure when unable to fault in pages, causing calling code to retry indefinitely without progress. This affects the test/development component and could lead to system hangs or denial of service in testing environments.
Technical details
The vulnerability is a logic error in lib/test_hmm.c where the dmirror_fault() function returns 0 (success) when mmget_not_zero() fails, indicating the mirrored mm has exited. This incorrect return value causes the caller's retry loop (in dmirror_read() and dmirror_write()) to repeatedly attempt the same fault operation, hitting -ENOENT and looping forever without making progress. The fix changes the return value from 0 to -EFAULT when the mirrored mm is no longer accessible. This is a test module vulnerability affecting kernel development/testing workflows, with no direct impact on production systems. The patch is upstream and available in the Linux kernel repository.
Affected products
- Linux Linux kernel Affects multiple versions via lib/test_hmm.c (testing module)
Timeline
- 2026-09-17: disclosed
- 2026-07-01: patched: Upstream patch commit 6a8024511ddf4877435c34fb3d6028aa8e590649