CVE-2026-89967 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/migrate_device: avoid out-of-bounds writes for compound folios
migrate_device_range() and migrate_device_pfns() clear the entries following a compound folio so that the PFN arrays retain their page-granular representation.
If a compound folio extends beyond the end of the caller-provided range, the loops clear all following folio entries without limiting them to the number of slots remaining in the npages-sized array, causing an out-of-bounds write.
Do not proceed with a compound folio if its page-granular representation does not fit entirely in the remaining PFN array. If this happens, drop any reference and lock acquired for the folio, clear the remaining entries, and stop collecting.
Observed with a KASAN x86 QEMU kernel using the HMM migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after migrating an anonymous huge page to device memory exercises:
dmirror_fops_release() -> dmirror_device_evict_chunk() -> migrate_device_range()
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the mm/migrate_device subsystem represents a critical out-of-bounds write condition that arises during the migration of compound folios to device memory. This flaw specifically affects functions such as migrate_device_range and migrate_device_pfns, which are responsible for managing page frame number arrays when moving data between system RAM and external devices via mechanisms like Heterogeneous Memory Management. The core technical failure occurs because these routines attempt to maintain a consistent page-granular representation within the PFN array by clearing entries that follow a compound folio. A compound folio consists of multiple contiguous physical pages treated as a single unit, typically associated with huge pages or large memory allocations. When such a folio is processed, the code iterates through its constituent pages to clear corresponding slots in the destination array. However, if the total span of the compound folio exceeds the boundaries defined by the caller-provided range and the allocated size of the PFN array, the loop continues writing beyond the valid memory limits. This lack of boundary checking results in heap or stack corruption depending on where the arrays are located, potentially leading to kernel panic, data integrity issues, or arbitrary code execution if an attacker can influence the allocation layout and trigger this specific path through controlled device interactions.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and system instability. By exploiting the out-of-bounds write, a local user with access to Heterogeneous Memory Management interfaces, such as /dev/hmm_dmirror0, can corrupt kernel memory structures adjacent to the PFN array. This corruption can overwrite function pointers, control flow data, or security-critical flags within the kernel space. The vulnerability is particularly dangerous because it involves device drivers and memory management subsystems that are often accessed by virtualization environments or specialized hardware acceleration frameworks. An attacker could leverage this flaw in a containerized environment to escape isolation boundaries if the host kernel processes untrusted workloads through these interfaces. Furthermore, the instability caused by heap corruption can lead to denial of service conditions, disrupting critical system operations and affecting other tenants sharing the same physical infrastructure.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing data beyond the allocated buffer boundaries due to insufficient validation of array indices relative to compound memory structures. In terms of attack vectors, it relates to ATT&CK technique T1059: Command and Scripting Interpreter if used in conjunction with other exploits for post-exploitation, but more directly maps to privilege escalation paths enabled by kernel memory corruption. The specific context involves device driver interaction, which often falls under the broader category of exploiting hardware abstraction layers or virtualization interfaces. Mitigation strategies primarily involve applying upstream Linux kernel patches that enforce strict bounds checking before processing compound folios in migration routines. System administrators should ensure their kernels are updated to versions where this logic has been corrected to verify that a compound folio fits entirely within the remaining PFN array slots. If it does not fit, the system must drop references and locks acquired for the folio, clear only the valid remaining entries, and halt collection rather than proceeding with unsafe writes. Additionally, restricting access to HMM device nodes like /dev/hmm_dmirror0 to trusted processes and enabling kernel hardening features such as KASAN in production environments can help detect similar issues early during development phases before they reach end-users.