CVE-2026-46277 (GCVE-0-2026-46277)
Vulnerability from cvelistv5
Published
2026-06-08 15:41
Modified
2026-08-05 12:30
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().
References
Impacted products
Vendor Product Version
Linux Linux Version: d245f9b4ab806733a77e51a218ca7b8bc3135cd9
Version: d245f9b4ab806733a77e51a218ca7b8bc3135cd9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "85be0a262e39c706edb53c88af8afde2e98222ba",
              "status": "affected",
              "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
              "versionType": "git"
            },
            {
              "lessThan": "39928984956037cabd304321cb8f342e47421db5",
              "status": "affected",
              "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/zone_device: do not touch device folio after calling -\u003efolio_free()\n\nThe contents of a device folio can immediately change after calling\n-\u003efolio_free(), as the folio may be reallocated by a driver with a\ndifferent order.  Instead of touching the folio again to extract the\npgmap, use the local stack variable when calling percpu_ref_put_many()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only when a ZONE_DEVICE folio is freed via `__folio_put()` \u2192 `free_zone_device_folio()`, which occurs during device-private memory migration teardown (e.g. `migrate_vma_finalize()` \u2192 `folio_put()` on source folios). That path is driven by local process activity\u2014mmap, CPU page faults on GPU-resident memory, and concurrent GPU allocation\u2014not by remote network packet handling.\nAC:L - Exploitation requires winning a race between `-\u003efolio_free()` returning a folio to a driver free list and `percpu_ref_put_many()` re-reading `folio-\u003epgmap`, but an attacker can control both sides by running concurrent GPU migration and allocation threads on the same device. No conditions outside attacker influence (specific memory layout, victim state) are required beyond normal GPU workload timing.\nPR:L - Triggering device-private folio migration and free requires only an unprivileged local user with access to a GPU render node (e.g. `/dev/dri/renderD*`, typically granted via the `render` group), not real root in the init namespace. No CAP_SYS_ADMIN or other elevated capability is needed to exercise the migrate/fault/alloc paths that reach `free_zone_device_folio()`.\nUI:N - Exploitation is fully automatable through GPU compute or graphics workloads that migrate memory between system RAM and device-private VRAM; no victim click, mount, or other deliberate interactive action beyond the attacker running their own program is required.\nS:U - Successful exploitation corrupts kernel memory and `dev_pagemap` refcounts to achieve kernel privilege escalation within the host kernel security boundary. It does not inherently cross a VM/host or IOMMU/DMA isolation boundary, even though GPU cloud tenants are a plausible deployment scenario.\nC:H - After `-\u003efolio_free()`, the folio may be immediately reallocated and its metadata overwritten; reading `folio-\u003epgmap` afterward is a use-after-free that can dereference attacker-influenced or stale pointers. Wrong `percpu_ref` targets can also cause premature `pgmap` teardown, enabling further kernel memory disclosure.\nI:H - Calling `percpu_ref_put_many()` on a corrupted or wrong `pgmap-\u003eref` (potentially with a large `nr` from a huge folio) corrupts kernel refcount state and adjacent memory, which is a standard path to arbitrary kernel write and control-flow hijack, not merely a bounded data change.\nA:H - Incorrect `percpu_ref_put_many()` on a stale or wrong `pgmap` can underflow refcounts, trigger use-after-free of `dev_pagemap`, or cause immediate kernel BUG/WARN/oops during memory teardown. Even without full exploit development, the bug reliably threatens kernel crashes and denial of service during device folio free."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:59.977Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5"
        }
      ],
      "title": "mm/zone_device: do not touch device folio after calling -\u003efolio_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46277",
    "datePublished": "2026-06-08T15:41:19.760Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:59.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.