HIGH Introduced in 6.19
mm CompoundFolio OOB
CVE-2026-89967
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: avoid out-of-bounds writes for compound folios migrate_device_range() and migrate_device_pfns() clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compound folio extends beyond the end of the caller-provided range, the loops clear all following folio entries without limiting them to the number of slots remaining in the npages-sized array, causing an out-of-bounds write. Do not proceed with a compound folio if its page-granular representation does not fit entirely in the remaining PFN array. If this happens, drop any reference and lock acquired for the folio, clear the remaining entries, and stop collecting. Observed with a KASAN x86 QEMU kernel using the HMM migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after migrating an anonymous huge page to device memory exercises: dmirror_fops_release() -> dmirror_device_evict_chunk() -> migrate_device_range()
02KernelScan AI Analysis
Risk summary
A local user with access to an HMM-capable device (such as a GPU) can trigger an out-of-bounds write in kernel memory by migrating a compound (transparent huge) page to device memory and then closing the device. The write corrupts kernel heap memory adjacent to the PFN array, potentially leading to privilege escalation or a kernel crash. Systems without HMM-capable devices or device-migration support are not affected.
Vulnerability analysis
When migrating compound (transparent huge) pages to device memory, the page-migration code clears PFN array entries following a compound folio to maintain page-granular representation. If a compound folio extends beyond the end of the caller-provided range, the clearing loop writes past the end of the array without checking how many slots remain, causing an out-of-bounds write into adjacent kernel heap memory. The fix adds a bounds check before processing a compound folio: if the folio's page-granular size exceeds the remaining array capacity, any lock and reference already acquired for the folio are released, the remaining entries are zeroed, and collection stops. This path is reachable by local users who have access to HMM-capable devices such as GPUs, through device file operations that trigger page migration to or from device memory.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.5 | 99186b185c24 |
| mainline | 6.19 | 7.3 | dc41e961a269 |