UBUNTU-CVE-2026-93217: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange() takes pmdtranshugelock(), whose pmdishuge() check returns true for a device-private PMD. The subsequent !pmdpresent() branch has a VMBUGON() asserting migration is the only allowed non-present case; a device-private PMD trips it. Skip device-private PMDs in that non-present branch and continue to hugeunlock before calling pmdfolio(). Downgrade the check to VMWARNONONCE() so an unexpected PMD softleaf logs a warning rather than panicking. Drop the thpmigrationsupported() guard: it expands to ISENABLED(CONFIGARCHSUPPORTSPMDSOFTLEAF), and both pmdismigrationentry() and pmdisdeviceprivateentry() already return false when that config is not selected, so the guard suppresses only the case where the warning would already be silent. Potential trigger: an HMM-based GPU driver races with madvise(MADVCOLD)/MADVPAGEOUT: pmdtranshuge(pmd) reads true, then migratevmapages() flips the PMD to a device-private entry before the PMD lock is acquired.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the kernel madvise cold/pageout PMD walk to skip device-private PMDs in the non-present branch, continue to huge_unlock before calling pmd_folio(), remove the thp_migration_supported() guard, and downgrade the subsequent unexpected non-present PMD assertion to VM_WARN_ON_ONCE() so it logs a warning instead of panicking.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The described trigger requires an HMM-based GPU driver and a race with madvise(MADV_COLD) or madvise(MADV_PAGEOUT). Systems without that driver and workload combination are not described as reaching the vulnerable condition.
What is the likely impact if the race occurs?
A device-private PMD can reach a VM_BUG_ON() intended only for migration entries, causing a kernel panic. The resolved behavior skips the device-private PMD and changes an unexpected softleaf condition from a panic to a one-time warning.
How can I determine whether a system may be affected?
Review whether the system uses one of the listed Ubuntu kernel packages and runs an HMM-based GPU driver. The relevant activity is concurrent GPU memory migration through migrate_vma_pages() and processes issuing MADV_COLD or MADV_PAGEOUT.
What can be done before a kernel update is available?
Avoid the described concurrency where practical: do not combine HMM-based GPU memory migration with MADV_COLD or MADV_PAGEOUT operations on the affected workload. The provided data does not identify another mitigation or configuration change.