HIGH Introduced in 6.17
drm/pagemap Migration UAF
CVE-2026-93284
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page information if it is called afterward. Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() so the pages array remains valid during DMA unmapping.
02KernelScan AI Analysis
Risk summary
A local user with access to a GPU driver using drm_pagemap can trigger a use-after-free during page migration error handling, potentially leading to kernel memory corruption, privilege escalation, or denial of service. The bug requires triggering a migration error path and is gated by GPU device access.
Vulnerability analysis
When the kernel handles an error during GPU page migration, it releases the page references before tearing down the associated DMA mappings. Because the release step clears the information needed for unmapping, the unmapping step can operate on freed or invalid page data, causing memory corruption. The fix reverses this order so DMA mappings are removed while the page information is still valid. A local process that can use the GPU memory migration functionality can reach this code.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.17 | 6.18.53 | e4331c6644db |
| 7.2 | 6.17 | 7.2.9 | 415f5a755cec |
| mainline | 6.17 | 7.3 | 9e6372ec2a39 |