Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()

Impact

When a ->pmd_entry() callback sets ACTION_AGAIN and the PMD is cleared on retry, walk->action is never reset, so the PUD-level retry added by an earlier fix re-invokes walk callbacks for a range already processed. For non-idempotent callers this is a heap out-of-bounds write; the report shows KASAN catching a slab-out-of-bounds write from __mincore_unmapped_range() reached through the ordinary mincore() syscall, triggered by an unprivileged local fuzzer. This is core memory management, not an optional subsystem, so it applies to every node in a fleet, and on a multi-tenant GPU host any tenant process with shell access can reach mincore(). Kernel heap corruption from an unprivileged syscall is a credible local privilege escalation path.

Who can reach it

Local, unprivileged. Any user process on the node that can call mincore() on a suitable mapping; no special capability or device access is required.

What to do

Move to a stable kernel carrying commit 895cd4ecbb2e (or the backport for your series) and reboot every node. There is no runtime toggle - mincore() is not something you can disable - so this is a full fleet reboot campaign, staged with drains.

References

Related entries

• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel mm/swap: hibernation slot freed while cached corrupts unrelated processes' memoryCVE-2026-89760 · Linux kernel mm/swap (hibernation slot freed while in the swap cache)High
• Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn downCVE-2026-89763 · Linux kernel KEYS trusted-key TPM backend (module teardown ordering)High
• Linux kernel perf: use-after-free when an mmap revival races the last munmap, giving local rootCVE-2026-89791 · Linux kernel perf subsystem (perf_mmap_close / ring-buffer revival race)High
• Linux kernel BPF: bpf_get_stackid runs get_perf_callchain preemptible, exposing its trace bufferCVE-2026-89799 · Linux kernel BPF (bpf_get_stackid, get_perf_callchain preemption)High