CVE-2026-89758

A flaw in the Linux kernel's memory-management policy code (queue_folios_pmd, used by mbind(), migrate_pages(), and set_mempolicy_home_node()) causes it to treat a non-present PMD holding a device-private swap entry as if it were a present transparent huge page. Such PMDs are created when an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate_vma_pages(), after which the kernel passes the PMD's softleaf encoding to pmd_folio() as though it were a hardware PFN, yielding a bogus folio pointer. Consequences range from a VM_BUG_ON() on debug kernels, to a kernel oops from a bogus vmemmap dereference, to silently isolating an unrelated live folio from the LRU — i.e., kernel memory corruption that a local attacker with low privileges could leverage for a crash or potentially privilege escalation (CVSS 3.1: 7.8). Only systems running an HMM-based GPU driver that performs device-private memory migration are exposed to the trigger. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Patch to a kernel containing the fix (patch series "mm: handle device-private PMDs in walk callbacks", v3) as soon as your distribution ships it. Until then, on GPU compute hosts using HMM device-private migration, avoid invoking mbind(), migrate_pages(), or set_mempolicy_home_node() over ranges that may hold device-private PMDs, or disable transparent huge pages / device-private migration as a workaround. Watch for kernel oops or VM_BUG_ON traces originating in queue_folios_pmd() as an indicator of the bug being hit.