Linux kernel drm_gem_shmem: PMD huge-page fault can map past the VMA end and trip VM_BUG_ON

Impact

The ->huge_fault handler in the DRM shared-memory GEM helper installed a PMD-sized mapping without checking that the huge page fits inside the VMA, so a local user who mmaps a shmem-backed GEM buffer at the right size and offset can create a mapping that extends past the end of the VMA. The record describes the consequence as a VM_BUG_ON_VMA() firing in copy_pmd_range(), i.e. a kernel BUG on the next fork of that address space - an oops or panic on the node rather than a controlled escape. NVD scores it 7.8 with confidentiality and integrity impact as well, but nothing in the record backs a read or write primitive beyond the out-of-bounds mapping itself. Reachability is narrow: this helper is used by shmem-backed DRM drivers such as virtio-gpu, not by the TTM-based amdgpu path or the out-of-tree NVIDIA driver, so on most bare-metal GPU hosts the exposed surface is a guest running virtio-gpu, not the accelerator itself.

Who can reach it

Local user who can open a DRM device node backed by drm_gem_shmem and mmap a GEM buffer - typically any tenant inside a VM with virtio-gpu, or any local user with render-node access. No authentication beyond device permissions, no remote path. Not reachable at all on hosts that load no shmem-backed DRM driver.

What to do

Pick up a stable kernel containing the two linked commits; there is no runtime mitigation short of denying DRM device access to untrusted local users. Applying it means rebooting each node into the new kernel, so schedule it with normal GPU-node drain-and-reboot maintenance rather than treating it as urgent - the described impact is a local crash, and on hosts with no shmem-backed DRM driver loaded the code is never entered.

References

Related entries

• Linux kernel drm/xe: userptr inject path takes notifier_lock for read, tripping a GPU SVM lock assertionCVE-2026-80606 · Linux kernel drm/xe userptr (notifier_lock held for read on the invalidation-inject path)High
• Linux kernel drm/vmwgfx: unvalidated offsets and strides overrun imported dma-buf maps in BO copyCVE-2026-80700 · Linux kernel drm/vmwgfx (vmw_external_bo_copy stride and offset validation)High
• Linux kernel drm/vmwgfx: boolean written to guest_memory_size drives out-of-bounds MOB dirty walksCVE-2026-80702 · Linux kernel drm/vmwgfx (vmw_resource guest_memory_size clobbered by boolean assignment)High
• nouveau UVMM: failed sparse-unmap bind job frees a live VA region, leading to use-after-freeCVE-2026-89801 · Linux kernel nouveau UVMM (nouveau_uvmm_bind_job_submit OP_UNMAP_SPARSE error paths)High
• nouveau: channel-kill event stays subscribed after the fence context is freed, racing teardownCVE-2026-89803 · Linux kernel nouveau (nouveau_channel_del teardown ordering, channel-kill event)High
• drm_pagemap: use-after-put in the device-to-RAM migration error path, plus missing THP fallbackCVE-2026-89805 · Linux kernel drm_pagemap (drm_pagemap_migrate_populate_ram_pfn folio fallback)High