Linux kernel mm/migrate_device: compound folio at the end of a range writes past the PFN array

Impact

migrate_device_range() and migrate_device_pfns() clear the array entries that follow a compound folio so the PFN array keeps its page-granular shape. When a compound folio extends past the end of the caller-supplied range, the loop clears every entry of that folio without stopping at the npages bound, writing off the end of the array. These are the helpers a driver calls to evict device memory, so the path is exercised by GPU drivers that use HMM device-private pages - the reporter hit it by closing an HMM test device after migrating an anonymous huge page to device memory. Impact is kernel memory corruption adjacent to the PFN array; the record does not establish a tenant-triggerable path, only that ordinary device-memory eviction with huge pages reaches it.

Who can reach it

Local, and only on nodes running a driver that uses device-private memory migration (HMM-backed GPU drivers, or the hmm_dmirror test driver). Triggered from a process holding the device file when a compound folio straddles the end of the migrated range; no network exposure.

What to do

Take the stable kernel fix that refuses a compound folio which does not fit in the remaining PFN array (commits 99186b185c24, dc41e961a269). Kernel change: install the patched kernel and reboot each affected node with GPU workloads drained. No standalone mitigation is named in the record.

References

Related entries

• Linux kernel mm/mempolicy: weighted-interleave bulk allocation sleeps in atomic contextCVE-2026-89986 · Linux kernel mm/mempolicy (alloc_pages_bulk_weighted_interleave GFP flags)High
• Linux kernel megaraid_sas: NVMe PRP list overruns the chain frame and corrupts other in-flight commandsCVE-2026-90008 · Linux kernel megaraid_sas (NVMe PRP chain frame)High
• Linux kernel SCSI bsg: TOCTOU on the shared io_uring SQE overflows the SCSI command bufferCVE-2026-90009 · Linux kernel SCSI bsg (io_uring passthrough command setup)High
• Linux kernel bsg: sense data copy ignores max_response_len and overruns the user bufferCVE-2026-90010 · Linux kernel SCSI bsg (io_uring sense copy)High
• Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor buildsCVE-2026-90046 · Linux kernel mm/page_alloc (free_pages_nolock in NMI on UP builds)High
• Linux kernel acomp: stack-request clone is undersized, letting async offload drivers write past the slab objectCVE-2026-90069 · Linux kernel crypto acomp (ACOMP_REQUEST_ON_STACK request cloning)High