CVE-2026-89967

A heap out-of-bounds write exists in the Linux kernel's device memory migration code: migrate_device_range() and migrate_device_pfns() clear the PFN-array entries that follow a compound folio to preserve a page-granular representation, but when a compound folio extends past the end of the caller-provided range, the clearing loops run past the npages-sized array. A local attacker who can trigger HMM device memory migration with an anonymous huge page can reach this path — in testing, closing /dev/hmm_dmirror0 after migrating an anonymous huge page to device memory walks dmirror_device_evict_chunk() -> migrate_device_range() — and corrupt adjacent kernel memory. Exploitation could lead to local privilege escalation or a kernel crash, consistent with the CVSS 7.8 high score (local access, high confidentiality/integrity/availability impact). Any Linux kernel with HMM device-memory migration support that predates the upstream fix is affected, though the source data does not specify exact vulnerable version ranges. There is no evidence of in-the-wild exploitation and no public proof-of-concept; the flaw was found using a KASAN-instrumented x86 QEMU kernel running the HMM migrate_anon_huge_zero selftest.

What to do: Update the kernel through your distribution's security channel to a build containing the upstream mm/migrate_device fix (which skips compound folios that do not fit in the remaining PFN array); no specific fixed version number was provided in the source data. As interim mitigations, restrict local unprivileged access on hosts using HMM-based device-memory drivers and avoid workloads that migrate anonymous huge pages to device memory. Check whether HMM device nodes such as /dev/hmm_dmirror0 are present and review kernel logs for memory-corruption or KASAN reports.