CVE-2026-93284: drm/pagemap: dma-unmap pages before handling migration errors

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/pagemap: dma-unmap pages before handling migration errors

drmpagemapmigrateunmappages() relies on the pages array to determine which pages require DMA unmapping. However, drmpagemapmigrationunlockputpages() clears the array as part of its cleanup, leaving drmpagemapmigrateunmappages() with no valid page information if it is called afterward.

Call drmpagemapmigrateunmappages() before drmpagemapmigrationunlockputpages() so the pages array remains valid during DMA unmapping.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() or other migration-error handling, so the pages array remains valid during DMA unmapping.

Event History

Sep 24, 2026
CVE Published
via MITRE·04:02 PM
Data Sourced
via MITRE·04:02 PM
Description

Frequently Asked Questions

1

Which systems are affected by this issue?

Systems running the Linux kernel with the DRM pagemap migration code are relevant. The provided information does not identify specific kernel versions, drivers, or hardware configurations.

2

What condition triggers the vulnerability?

It occurs on a migration error path when page cleanup clears the pages array before DMA unmapping is performed. The DMA-unmap routine then lacks valid page information needed to identify pages requiring unmapping.

3

What is the remediation?

Apply a kernel update containing the change that calls drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages(). The supplied references point to stable kernel commits containing the fix.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203