Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folio

Impact

Since device-private THP support landed, a PMD can hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory. pmd_trans_huge_lock() accepts any non-present, non-none huge PMD, so queue_folios_pmd() hands that softleaf encoding to pmd_folio(), which treats it as a hardware PFN and returns a bogus folio pointer. Per the patch series cover letter the outcomes range from a VM_BUG_ON on debug kernels to an oops on a bad vmemmap dereference to silently isolating an unrelated live folio from the LRU. The trigger is ordinary NUMA policy work - mbind(), migrate_pages() or set_mempolicy_home_node() - on a range whose THP the GPU driver has moved to device memory, which is exactly the combination a NUMA-tuned GPU node produces.

Who can reach it

Local, unprivileged. A process on a node with an HMM-based GPU driver that migrates an anonymous THP to device memory, then calls mbind(), migrate_pages() or set_mempolicy_home_node() over that range.

What to do

Update to a stable kernel carrying commit 2858b4027f49 or 3d927093b2ad and reboot affected GPU nodes. Only the first of a three-patch series is covered by this id; make sure the backport you take includes the rest of the device-private PMD walk-callback series.

References

Related entries

• Linux kernel mm/swap: hibernation slot freed while cached corrupts unrelated processes' memoryCVE-2026-89760 · Linux kernel mm/swap (hibernation slot freed while in the swap cache)High
• Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn downCVE-2026-89763 · Linux kernel KEYS trusted-key TPM backend (module teardown ordering)High
• Linux kernel perf: use-after-free when an mmap revival races the last munmap, giving local rootCVE-2026-89791 · Linux kernel perf subsystem (perf_mmap_close / ring-buffer revival race)High
• Linux kernel BPF: bpf_get_stackid runs get_perf_callchain preemptible, exposing its trace bufferCVE-2026-89799 · Linux kernel BPF (bpf_get_stackid, get_perf_callchain preemption)High
• Linux kernel qla2xxx: use-after-free reading 84xx_fw_version during Fibre Channel HBA teardownCVE-2026-89854 · Linux kernel scsi qla2xxx (cs84xx chip release vs. 84xx_fw_version sysfs read)High
• Linux kernel mm/migrate_device: compound folio at the end of a range writes past the PFN arrayCVE-2026-89967 · Linux kernel mm/migrate_device (device-private page migration)High