Linux kernel migrate_vma: page-table page leaked when huge PMD insertion aborts

CVSS 5.5CVE-2026-63953Kernel, userspace & hypervisorcurated

Impact

The device-private migration path used by GPU drivers to move pages between host memory and device memory allocates a page-table page with pte_alloc_one() and never frees it when a PMD consistency check fails and the code jumps to unlock_abort. Each failed huge-PMD insertion permanently leaks one page-table page. On a GPU node whose tenants drive heavy unified-memory or HMM migration traffic, repeated aborts slowly consume unreclaimable kernel memory until the node needs a reboot to recover. There is no information disclosure and no privilege boundary crossed - the cost is availability on a node that is expensive to drain.

Who can reach it

Local. Any process on the node that can drive device-private memory migration - in practice a tenant workload using a GPU driver that implements migrate_vma - can repeatedly hit the abort path. No special privilege beyond access to the accelerator device nodes.

What to do

Take the stable kernel patch that adds the free_abort label (commits linked in the record) and reboot each node onto the fixed kernel; there is no runtime mitigation and the leak is not reclaimable without a reboot. The record does not name a fixed release version, only the stable commits.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63953 https://git.kernel.org/stable/c/24861d04f197bb651e9dfb211978271c15f75a98 https://git.kernel.org/stable/c/2c6f81d58741349298f51ff697d988cb42881453

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.