Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folio

Impact

Since device-private THP support landed, a PMD can hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory. pmd_trans_huge_lock() accepts any non-present, non-none huge PMD, so queue_folios_pmd() hands that softleaf encoding to pmd_folio(), which treats it as a hardware PFN and returns a bogus folio pointer. Per the patch series cover letter the outcomes range from a VM_BUG_ON on debug kernels to an oops on a bad vmemmap dereference to silently isolating an unrelated live folio from the LRU. The trigger is ordinary NUMA policy work - mbind(), migrate_pages() or set_mempolicy_home_node() - on a range whose THP the GPU driver has moved to device memory, which is exactly the combination a NUMA-tuned GPU node produces.

Who can reach it

Local, unprivileged. A process on a node with an HMM-based GPU driver that migrates an anonymous THP to device memory, then calls mbind(), migrate_pages() or set_mempolicy_home_node() over that range.

What to do

Update to a stable kernel carrying commit 2858b4027f49 or 3d927093b2ad and reboot affected GPU nodes. Only the first of a three-patch series is covered by this id; make sure the backport you take includes the rest of the device-private PMD walk-callback series.

References

Related entries

• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High
• Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theCVE-2021-47130 · Linux kernel (drivers/nvme/target)High