CVE-2026-63953: mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
Published Jul 19, 2026
·
Updated
In the Linux kernel, the following vulnerability has been resolved:
mm/migratedevice: fix pgtable leak in migratevmainserthugepmdpage
When migratevmainserthugepmdpage() jumps to unlockabort due
to a PMD check failure, the pgtable allocated earlier via
pteallocone() is never freed, causing a memory leak.
Added freeabort label to release the pgtable in error path.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
The leak occurs when migrate_vma_insert_huge_pmd_page() has allocated a page table through pte_alloc_one() and then takes its unlock_abort error path because a PMD check fails. The provided data does not identify a specific workload or configuration that causes that PMD check failure.
2
What is the practical impact?
The affected error path leaks the allocated page-table memory. The stated impact is availability, consistent with memory consumption accumulating if the vulnerable path is repeatedly reached; no confidentiality or integrity impact is indicated.
3
Is there a mitigation if patching cannot happen immediately?
No specific workaround or configuration change is provided. Apply the available patch when possible; the fix adds cleanup on the error path to free the previously allocated page table.