PT-2026-47352 · Linux · Linux

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-46280

NVD

In the Linux kernel, the following vulnerability has been resolved:

lib: test hmm: evict device pages on file close to avoid use-after-free

Patch series "Minor hmm test fixes and cleanups".

Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems.

This patch (of 3):

When dmirror fops release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone device data pointer to the freed dmirror.

If a subsequent fault occurs on those pages (eg. during coredump) the dmirror devmem fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages.

Fix this by calling dmirror device evict chunk() for each devmem chunk in dmirror fops release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration.

Related Identifiers

CVE-2026-46280

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46280 · Security Note
• https://git.kernel.org/stable/c/bf477abd448c76bb8ea51c9b4f63a3a17c4b6239 · Note
• https://git.kernel.org/stable/c/5846715b6382dd4c6a69b35a56ca6115d33bc2a0 · Note
• https://git.kernel.org/stable/c/38f113f81d3f0adc658a4475dd3ecaec985e21d3 · Note
• https://git.kernel.org/stable/c/9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1 · Note
• https://git.kernel.org/stable/c/744dd97752ef1076a8d8672bb0d8aa2c7abc1144 · Note