Linux kernel mm/rmap: stale batch count corrupts folio refcounts on device-exclusive pages

Impact

try_to_unmap_one() does not reset nr_pages at the start of each page-table walk iteration, so a count computed by a previous folio_unmap_pte_batch() call is reused on a later entry that never re-ran the batching. When the later entry is a device-exclusive PTE, the wrong page count is applied to folio refcount and mapcount updates, corrupting them. Device-exclusive PTEs are created by the HMM path that accelerator drivers use for coherent device memory, so this is reachable on GPU nodes doing unified or managed memory, combined with a lazyfree (MADV_FREE) large folio and node reclaim. The reported userspace-visible effect is a kernel crash from refcount/mapcount corruption - an unscheduled loss of the whole node and every tenant on it.

Who can reach it

Local, unprivileged, on a node where a driver provides HMM device-exclusive mappings. The reproducer maps a 64K anonymous large folio with MAP_DROPPABLE, calls madvise(MADV_FREE), makes the last page device-exclusive through the driver, and triggers node reclaim. Any tenant with an accelerator device node and the ability to pressure memory is in a position to drive it.

What to do

Patch the kernel to a stable release that initializes nr_pages to 1 at the top of the loop, then drain and reboot each node. Nodes whose accelerator drivers never create device-exclusive PTEs are not exposed. No mitigation short of the patch is published; the upstream note records that further device-private/rmap interaction bugs were still under investigation, so treat this as one fix in an area that may see more.

References

Related entries

• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High
• Linux kernel cgroup/rstat: BPF kfunc accepts an unvalidated CPU index for per-cpu lookupsCVE-2026-64036 · Linux kernel cgroup/rstat (css_rstat_updated BPF kfunc)High
• Linux kernel nvme-pci: use-after-free when Host Memory Buffer setup fails during device probeCVE-2026-64071 · Linux kernel nvme-pci (Host Memory Buffer teardown)High
• Linux kernel adm1266 hwmon: PDIO scan bound confused with PMBus command code, out-of-bounds read and writeCVE-2026-64084 · Linux kernel hwmon pmbus/adm1266 (GPIO/PDIO get_multiple bound)High
• Linux kernel adm1266 hwmon: device-supplied block length overflows the blackbox NVMEM buffer by 191 bytesCVE-2026-64085 · Linux kernel hwmon pmbus/adm1266 (blackbox NVMEM record read)High