CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
In the Linux kernel, the following vulnerability has been resolved:
mm: migratedevice: fix ptepfn/ptedirty called on non-present PTE
ptepfn() and ptedirty() have undefined behaviour when called on a non-present PTE. In migratevmacollectpmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from ptepfn() or incorrect dirty folio accounting from ptedirty(). Fix both by guarding with ptepresent() checks.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using Linux kernel device-memory migration paths that can process non-present PTEs, including device-private entries, are the relevant exposure scope. The issue occurs in migrate_vma_collect_pmd().
What condition triggers the faulty behavior?
The migration code must call pte_pfn() or pte_dirty() on a non-present PTE. This can cause a crash through pte_pfn() or incorrect dirty-folio accounting through pte_dirty().