CVE-2026-80686 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from pte_pfn() or incorrect dirty folio accounting from pte_dirty(). Fix both by guarding with pte_present() checks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel memory management subsystem contains a critical flaw within the virtual memory migration logic, specifically in the migrate_vma_collect_pmd function. This vulnerability arises from improper handling of page table entries that are not currently mapped to physical memory pages. In modern operating systems, particularly those supporting device-private memory or GPU-accelerated computing environments, page tables can contain various types of non-standard entries such as swap entries, reserved bits, or device-specific mappings. The core issue is that the code invokes pte_pfn and pte_dirty functions on these potentially non-present entries without first verifying their validity status. This represents a fundamental violation of memory management safety principles where operations are performed on data structures in an undefined state.
The technical root cause lies in the assumption that all page table entries encountered during migration collection represent valid, present mappings to physical frames. When pte_pfn is called on a non-present entry, it attempts to extract a frame number from bits that may not contain such information or may be reserved for other purposes. This leads to undefined behavior which can manifest as kernel panics due to invalid memory access patterns or corrupted internal state calculations. Similarly, the call to pte_dirty on these entries results in incorrect accounting of dirty pages. Dirty page tracking is essential for write-back operations and data consistency; erroneous flags here can lead to data loss during system crashes or improper synchronization between CPU and device memory spaces.
From a security perspective, this vulnerability falls under CWE-476 which denotes NULL Pointer Dereference risks, although in this specific kernel context it more accurately aligns with CWE-120 Buffer Overflow if the undefined behavior leads to out-of-bounds writes through corrupted pointers derived from invalid PTE values. Furthermore, the potential for causing a denial of service via system crash places this within the scope of availability attacks often categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service. The vulnerability is particularly relevant in environments utilizing Unified Memory Architecture or GPU compute workloads where device-private pages are frequently migrated between host and device memory spaces. Attackers with local access could potentially trigger these code paths through crafted applications that manipulate virtual memory mappings, thereby inducing system instability.
The operational impact of this flaw includes immediate kernel crashes leading to complete service unavailability on affected systems. Beyond simple denial of service, the incorrect dirty folio accounting poses a subtle but severe risk to data integrity. If the kernel incorrectly marks pages as clean when they are actually modified, or vice versa, subsequent write-back operations may fail to persist changes to storage media. This can result in silent data corruption for applications relying on persistent memory semantics or database systems that depend on accurate dirty page tracking for crash recovery mechanisms. In high-performance computing clusters where reliability is paramount, such instability undermines trust in the underlying infrastructure and can lead to significant financial and operational losses due to interrupted computations and lost workloads.
Mitigation strategies primarily involve applying the upstream kernel patch that introduces explicit presence checks before invoking these helper functions. System administrators should ensure their Linux kernels are updated to versions containing this fix, which typically involves guarding pte_pfn and pte_dirty calls with a preceding pte_present check. This ensures that operations are only performed on entries known to map to valid physical pages. For organizations unable to immediately patch production systems, monitoring for kernel oops messages related to page table manipulation or memory migration failures can help detect exploitation attempts. Additionally, restricting unprivileged access to virtual memory management interfaces and enforcing strict sandboxing policies around applications handling device-private memory regions can reduce the attack surface until patches are deployed.