CVE-2026-93284: drm/pagemap: dma-unmap pages before handling migration errors
In the Linux kernel, the following vulnerability has been resolved:
drm/pagemap: dma-unmap pages before handling migration errors
drmpagemapmigrateunmappages() relies on the pages array to determine which pages require DMA unmapping. However, drmpagemapmigrationunlockputpages() clears the array as part of its cleanup, leaving drmpagemapmigrateunmappages() with no valid page information if it is called afterward.
Call drmpagemapmigrateunmappages() before drmpagemapmigrationunlockputpages() so the pages array remains valid during DMA unmapping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() or other migration-error handling, so the pages array remains valid during DMA unmapping.
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems running the Linux kernel with the DRM pagemap migration code are relevant. The provided information does not identify specific kernel versions, drivers, or hardware configurations.
What condition triggers the vulnerability?
It occurs on a migration error path when page cleanup clears the pages array before DMA unmapping is performed. The DMA-unmap routine then lacks valid page information needed to identify pages requiring unmapping.
What is the remediation?
Apply a kernel update containing the change that calls drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages(). The supplied references point to stable kernel commits containing the fix.