Description
In the Linux kernel, the following vulnerability has been resolved:

mm/page_vma_mapped: fix device-private PMD handling

Commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support
device-private entries") introduced the concept of device-private PMD
entries, but did not correctly update the rmap walk code to account for
them.

As a result, when page_vma_mapped_walk() encounters device-private PMD
entries, it takes no action other than to acquire the PMD lock and exit.

However this is highly problematic for two reasons - firstly, device
private entries possess a PFN so check_pmd() needs to be called to ensure
an overlapping PFN range.

Secondly, and more importantly, if PVMW_MIGRATION is set the caller
assumes the returned entry is a migration entry, resulting in memory
corruption when the caller tries to interpret the device private entry as
such.

In addition, commit 146287290023 ("mm/huge_memory: implement
device-private THP splitting") allowed device private PMDs to be split
like THP mappings, but again did not update this code path.

As a result, we might race a PMD split prior to acquiring the PMD lock.

This patch addresses all of these issues by invoking check_pmd(), ensuring
PMVW_MIGRATION is not set and checks whether a split raced us we do for
PMD THP and migration entries.

Instead of checking for a subset of the cases after taking the pmd_lock(),
put device-private along with pmd_trans_huge() and
pmd_is_migration_entry(). Also remove thp_migration_supported() as it is
already guarded by pmd_is_migration_entry().

[akpm@linux-foundation.org: fix Raspberry Pi 1 build, per David]
Published: 2026-08-10
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel memory manager has a flaw in the mm/page_vma_mapped_walk routine that fails to handle device-private PMD entries correctly. The bug is identified as a type of improper handling enumerated as CWE-843, which leads to incorrect processing of memory page descriptors. When the routine encounters a device-private entry it only acquires the PMD lock and exits without validating the PFN or accounting for migration flags. If the PVMW_MIGRATION flag is set, the caller misinterprets the entry as a migration entry, causing kernel memory corruption.

Affected Systems

All Linux kernel releases from the Linux kernel project that have not incorporated the fixes introduced by commits 65edfda6f3f2 and 146287290023 are affected. These include a wide array of distributions and server builds that still ship older kernels.

Risk and Exploitability

The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploit is known. The likely attack vector is local, requiring an attacker to trigger the faulty code path on a system that uses device-private PMD entries. The CVSS score of 7.8 reflects the potential for memory corruption but limited availability and exploitation complexity. The patch addresses the issue by correctly invoking check_pmd, ensuring migration flags are cleared, and protecting against PMD split races.

Generated by OpenCVE AI on August 13, 2026 at 23:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that incorporates commits 65edfda6f3f2 and 146287290023 which contain the necessary fix.
  • If a kernel upgrade is not immediately possible, consider disabling support for device-private PMD entries by adjusting the kernel configuration to remove that feature.
  • Continue to monitor system stability for kernel panics or abnormal memory behavior and apply any vendor security advisories promptly.

Generated by OpenCVE AI on August 13, 2026 at 23:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 13 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-665

Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}

threat_severity

Moderate

Mon, 10 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-665

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mm/page_vma_mapped: fix device-private PMD handling Commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support device-private entries") introduced the concept of device-private PMD entries, but did not correctly update the rmap walk code to account for them. As a result, when page_vma_mapped_walk() encounters device-private PMD entries, it takes no action other than to acquire the PMD lock and exit. However this is highly problematic for two reasons - firstly, device private entries possess a PFN so check_pmd() needs to be called to ensure an overlapping PFN range. Secondly, and more importantly, if PVMW_MIGRATION is set the caller assumes the returned entry is a migration entry, resulting in memory corruption when the caller tries to interpret the device private entry as such. In addition, commit 146287290023 ("mm/huge_memory: implement device-private THP splitting") allowed device private PMDs to be split like THP mappings, but again did not update this code path. As a result, we might race a PMD split prior to acquiring the PMD lock. This patch addresses all of these issues by invoking check_pmd(), ensuring PMVW_MIGRATION is not set and checks whether a split raced us we do for PMD THP and migration entries. Instead of checking for a subset of the cases after taking the pmd_lock(), put device-private along with pmd_trans_huge() and pmd_is_migration_entry(). Also remove thp_migration_supported() as it is already guarded by pmd_is_migration_entry(). [akpm@linux-foundation.org: fix Raspberry Pi 1 build, per David]
Title mm/page_vma_mapped: fix device-private PMD handling
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:00:02.619Z

Reserved: 2026-07-30T09:28:09.372Z

Link: CVE-2026-68163

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-10T13:20:02.720

Modified: 2026-08-17T05:18:16.830

Link: CVE-2026-68163

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-10T11:59:30Z

Links: CVE-2026-68163 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T00:00:04Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')