Linux kernel mm: DAX hotplug into an early section leaves ZONE_DEVICE tail struct pages uninitialized

Impact

When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap while compound_nr_pages() still assumes vmemmap optimization is in effect, so only the reduced count of struct pages gets initialized and the tail pages are left uninitialized. Later use of those pages gives undefined behaviour or a crash. Exposure is configuration-gated: it requires ZONE_DEVICE/DAX capacity actually being hotplugged, which on a fleet means CXL or persistent-memory-backed hosts, and hotplug is an administrative action rather than something a tenant drives. Where it does apply the failure mode is a host crash, which on a GPU node means losing every accelerator on the box at once. The record describes the fix and the trigger; it does not show a tenant-controllable path.

Who can reach it

Not tenant-reachable in the usual configuration. It requires DAX/ZONE_DEVICE memory hotplug on the host, a root-level operation, and hosts with no DAX or CXL memory hotplug are unaffected. Despite the local-attacker CVSS supplied with the record, treat this as a stability bug on memory-hotplug-capable nodes rather than an attack surface.

What to do

Update to a stable kernel that treats early sections as unoptimized when computing how many struct pages to initialize (five stable commits linked) and reboot. Nodes with no DAX/CXL memory hotplug configured can take this on the normal patch cadence; hosts that do hotplug device memory should get it before the next hotplug event. No mitigation short of not hotplugging DAX memory.

References

Related entries

• Linux kernel (arch/x86/kvm/vmx): The nested vTPR versus TPR-threshold consistency check ran only after KVM had alreadyCVE-2026-72287 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A use-after-free in the amdkfd (KFD compute driverCVE-2026-72449 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches theCVE-2026-72450 · Linux kernel (net/xfrm)High
• Linux kernel mlx5_ib (queue pair sizing): set_rq_size() computes the receive-queue work-entry size as 1 << rq_wqe_shiftCVE-2026-74297 · Linux kernel mlx5_ib (queue pair sizing)High
• Linux kernel (drivers/vfio/pci/qat): Two concurrent writes to the QAT VF migration-resume file both pass the boundsCVE-2026-74306 · Linux kernel (drivers/vfio/pci/qat)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2026-74446 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High