CVE-2026-93217: mm/madvise: skip device-private PMDs in cold and pageout walks
In the Linux kernel, the following vulnerability has been resolved:
mm/madvise: skip device-private PMDs in cold and pageout walks
madvisecoldorpageoutpterange() takes pmdtranshugelock(), whose pmdishuge() check returns true for a device-private PMD. The subsequent !pmdpresent() branch has a VMBUGON() asserting migration is the only allowed non-present case; a device-private PMD trips it.
Skip device-private PMDs in that non-present branch and continue to hugeunlock before calling pmdfolio(). Downgrade the check to VMWARNONONCE() so an unexpected PMD softleaf logs a warning rather than panicking. Drop the thpmigrationsupported() guard: it expands to ISENABLED(CONFIGARCHSUPPORTSPMDSOFTLEAF), and both pmdismigrationentry() and pmdisdeviceprivateentry() already return false when that config is not selected, so the guard suppresses only the case where the warning would already be silent.
Potential trigger: an HMM-based GPU driver races with madvise(MADVCOLD)/MADVPAGEOUT: pmdtranshuge(pmd) reads true, then migratevmapages() flips the PMD to a device-private entry before the PMD lock is acquired.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The described trigger requires an HMM-based GPU driver using device-private memory and a race with madvise(MADV_COLD) or madvise(MADV_PAGEOUT). Systems without that combination are not identified as affected by the provided data.
What must happen for the issue to be triggered?
A cold or pageout madvise walk must observe a PMD as transparent huge, after which migrate_vma_pages() changes that PMD to a device-private entry before the PMD lock is acquired. The existing non-present PMD assertion can then be tripped.
What is the impact of triggering the vulnerable path?
The device-private PMD can violate a VM_BUG_ON() assertion that expects migration to be the only permitted non-present case, potentially causing a kernel panic. The fix skips device-private PMDs and changes the unexpected-PMD check to a warning.