Executive brief
The Linux kernel's memory advisory system can panic when processing memory pages used by GPU drivers. A race condition between GPU memory operations and system memory reclamation triggers an assertion failure, causing the kernel to crash. Systems using heterogeneous memory devices like GPUs are vulnerable to denial of service from local processes issuing memory advice calls.
Technical details
The madvise_cold_or_pageout_pte_range() function performs unsafe assumption checks on page table entries when handling memory advice (MADV_COLD, MADV_PAGEOUT). A race with HMM-based GPU drivers allows a device-private page table entry to reach the !pmd_present() assertion check, which unconditionally triggers VM_BUG_ON() and panics the kernel. The fix downgrades the check to a warning and explicitly handles device-private entries.
Affected products
- Linux Linux kernel 5.12 and later (vulnerable code introduced in 368076f52ebe, fixed in d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2)
Timeline
- 2026-09-24: disclosed
- 2026-08-04: patched