Linux kernel migrate_device: pte_pfn/pte_dirty called on non-present PTEs during device migration

Impact

migrate_vma_collect_pmd() is the collection step of the HMM device-memory migration path - the code a GPU driver runs when moving pages between system memory and device memory. It could call pte_pfn() and pte_dirty() on non-present entries such as device-private entries, where both have undefined behaviour; the record states this can crash in pte_pfn() and produce incorrect dirty-folio accounting. On a GPU node this path is entered by ordinary unified/shared virtual memory use, so the failure is a host kernel crash on a machine holding many running jobs rather than a contained per-process fault. Nodes running no driver that creates device-private entries never reach the code.

Who can reach it

Local: a process using GPU unified/shared virtual memory on a driver that creates device-private pages (for example amdkfd SVM or nouveau). No remote or unauthenticated path.

What to do

Update to a stable kernel carrying the pte_present() guards and reboot the node. The fix is in core mm, so there is no module reload or runtime toggle that avoids it; the only alternative is not running workloads that trigger device page migration.

References

Related entries

• Linux iommufd: vDEVICE alloc error path leaks the igroup mutex and deadlocks later vDEVICE operationsCVE-2026-80687 · Linux kernel iommufd/viommu (vDEVICE alloc ioctl igroup lock)Unscored
• Linux kernel idxd: double free of wq, engine and group structs on setup error and cleanup pathsCVE-2026-80698 · Linux kernel dmaengine idxd (Intel DSA/IAA wq, engine and group device setup)Unscored
• Linux kernel KVM arm64 vGIC: double-deactivate of nested IRQs trips an AmpereOne erratumCVE-2026-80699 · Linux kernel KVM/arm64 vGIC (nested-context IRQ deactivation)Unscored
• Linux kernel MGLRU: stale batch updates after memcg reparenting cause premature OOM killsCVE-2026-80719 · Linux kernel mm MGLRU (per-generation batch accounting across memcg reparenting)Unscored
• Linux kernel KVM x86 MMU: invalid parent role propagates to child shadow pages, use-after-freeCVE-2026-80726 · Linux kernel KVM x86 shadow MMU (child shadow page role derivation)Unscored
• Linux kernel x86/mce: CMCI discovery kicks the MCE polling timer before it is initializedCVE-2026-80727 · Linux kernel x86 MCE (CMCI discovery vs. polling timer initialization order)Unscored