Linux kernel migrate_device: pte_pfn/pte_dirty called on non-present PTEs during device migration

CVE-2026-80686Kernel, userspace & hypervisorcurated

Impact

migrate_vma_collect_pmd() is the collection step of the HMM device-memory migration path - the code a GPU driver runs when moving pages between system memory and device memory. It could call pte_pfn() and pte_dirty() on non-present entries such as device-private entries, where both have undefined behaviour; the record states this can crash in pte_pfn() and produce incorrect dirty-folio accounting. On a GPU node this path is entered by ordinary unified/shared virtual memory use, so the failure is a host kernel crash on a machine holding many running jobs rather than a contained per-process fault. Nodes running no driver that creates device-private entries never reach the code.

Who can reach it

Local: a process using GPU unified/shared virtual memory on a driver that creates device-private pages (for example amdkfd SVM or nouveau). No remote or unauthenticated path.

What to do

Update to a stable kernel carrying the pte_present() guards and reboot the node. The fix is in core mm, so there is no module reload or runtime toggle that avoids it; the only alternative is not running workloads that trigger device page migration.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80686 https://git.kernel.org/stable/c/26f9ca8ed42cba25d2c75daff13561cce6019395 https://git.kernel.org/stable/c/2be94d6b20789b8865b1864dae5fe458ca85e019 https://git.kernel.org/stable/c/42f30fa5481a1f90571ccdfbb20d2e25e47ae76e

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.