CVE-2026-90391: lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

lib/testhmm: fail dmirrorfault() when the mirrored mm is gone

dmirrorfault() is called from the dmirrorread() and dmirrorwrite() retry loops after dmirrordoread() or dmirrordowrite() finds a missing device page table entry.

If the mirrored mm has already exited, mmgetnotzero() fails. The current code returns 0 in that case, which tells the caller that faulting succeeded even though no page was faulted and no device page table entry was installed. The caller then retries the same address, hits -ENOENT again, and can loop forever without making progress.

Return -EFAULT instead, so the ioctl fails when the mirrored mm is no longer faultable.

Event History

Sep 17, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description

Frequently Asked Questions

1

What condition triggers the non-terminating retry behavior?

It occurs when dmirror_read() or dmirror_write() encounters a missing device page-table entry after the mirrored memory-management context has exited. In that state, mmget_not_zero() fails, but the previous behavior reported the fault as successful and caused retries of the same address.

2

What is the practical impact of the fix?

The affected ioctl now fails with -EFAULT when the mirrored mm can no longer be faulted. This prevents repeated -ENOENT retries that could otherwise loop indefinitely without installing a device page-table entry.

3

How can an affected system be identified from runtime behavior?

A relevant symptom is a dmirror read or write ioctl repeatedly retrying the same address after a missing device page-table entry is reported, with no forward progress. The condition specifically requires that the associated mirrored mm has already exited.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203