Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcounts

Impact

__migrate_device_pages() caches the folio mapping before calling folio_free_swap(); when that call removes the folio from the swap cache, the saved mapping still points at swap_space, and folio_migrate_mapping() then takes the mapped-folio path against swap_space.i_pages with wrong reference accounting, eventually hitting a folio refcount BUG. A related bug leaves nr set to the original large-folio page count after a split. This path is the device-private page migration used by HMM-based GPU drivers, so it is exercised precisely on nodes doing GPU memory oversubscription or unified-memory migration - a GPU-specific code path rather than a generic mm corner. The result is kernel memory accounting corruption and a BUG on a node that is running GPU work.

Who can reach it

Local. Requires a workload that drives device-private page migration through an HMM-capable GPU driver while the folios involved are in the swap cache; any tenant running GPU code on such a node exercises the path.

What to do

Update to a stable kernel containing commit 34a00895d032 or 8ffedc6573a6 and reboot the GPU nodes. The path is only reachable on hosts with HMM device-private migration in use, so nodes without an HMM-based GPU driver can be deferred.

References

Related entries

• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High