CVE-2026-93217: mm/madvise: skip device-private PMDs in cold and pageout walks
In the Linux kernel, the following vulnerability has been resolved:
mm/madvise: skip device-private PMDs in cold and pageout walks
madvisecoldorpageoutpterange() takes pmdtranshugelock(), whose pmdishuge() check returns true for a device-private PMD. The subsequent !pmdpresent() branch has a VMBUGON() asserting migration is the only allowed non-present case; a device-private PMD trips it.
Skip device-private PMDs in that non-present branch and continue to hugeunlock before calling pmdfolio(). Downgrade the check to VMWARNONONCE() so an unexpected PMD softleaf logs a warning rather than panicking. Drop the thpmigrationsupported() guard: it expands to ISENABLED(CONFIGARCHSUPPORTSPMDSOFTLEAF), and both pmdismigrationentry() and pmdisdeviceprivateentry() already return false when that config is not selected, so the guard suppresses only the case where the warning would already be silent.
Potential trigger: an HMM-based GPU driver races with madvise(MADVCOLD)/MADVPAGEOUT: pmdtranshuge(pmd) reads true, then migratevmapages() flips the PMD to a device-private entry before the PMD lock is acquired.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Update madvise_cold_or_pageout_pte_range() so device-private PMDs in the non-present branch are skipped and execution continues to huge_unlock before pmd_folio(); replace the migration-only VM_BUG_ON() with VM_WARN_ON_ONCE() and drop the thp_migration_supported() guard.
Linux kernel mm/madvise madvise_cold_or_pageout_pte_range() non-present PMD handling = Skip device-private PMDs; use VM_WARN_ON_ONCE() instead of VM_BUG_ON(); remove the thp_migration_supported() guard
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The described trigger requires an HMM-based GPU driver using device-private memory and a race with madvise(MADV_COLD) or madvise(MADV_PAGEOUT). Systems without that combination are not identified as affected by the provided data.
What must happen for the issue to be triggered?
A cold or pageout madvise walk must observe a PMD as transparent huge, after which migrate_vma_pages() changes that PMD to a device-private entry before the PMD lock is acquired. The existing non-present PMD assertion can then be tripped.
What is the impact of triggering the vulnerable path?
The device-private PMD can violate a VM_BUG_ON() assertion that expects migration to be the only permitted non-present case, potentially causing a kernel panic. The fix skips device-private PMDs and changes the unexpected-PMD check to a warning.