Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()

Impact

When a ->pmd_entry() callback sets ACTION_AGAIN and the PMD is cleared on retry, walk->action is never reset, so the PUD-level retry added by an earlier fix re-invokes walk callbacks for a range already processed. For non-idempotent callers this is a heap out-of-bounds write; the report shows KASAN catching a slab-out-of-bounds write from __mincore_unmapped_range() reached through the ordinary mincore() syscall, triggered by an unprivileged local fuzzer. This is core memory management, not an optional subsystem, so it applies to every node in a fleet, and on a multi-tenant GPU host any tenant process with shell access can reach mincore(). Kernel heap corruption from an unprivileged syscall is a credible local privilege escalation path.

Who can reach it

Local, unprivileged. Any user process on the node that can call mincore() on a suitable mapping; no special capability or device access is required.

What to do

Move to a stable kernel carrying commit 895cd4ecbb2e (or the backport for your series) and reboot every node. There is no runtime toggle - mincore() is not something you can disable - so this is a full fleet reboot campaign, staged with drains.

References

Related entries

• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh