Linux Kernel up to 7.2.3 Device Migration mm/migrate_device __migrate_device_pages reference count

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.3. It has been declared as very critical. This issue affects the function __migrate_device_pages of the file mm/migrate_device of the component Device Migration. Executing a manipulation can lead to reference count. The identification of this vulnerability is CVE-2026-89755. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.3. It has been declared as very critical. This vulnerability affects the function __migrate_device_pages of the file mm/migrate_device of the component Device Migration. The manipulation with an unknown input leads to a reference count vulnerability. The CWE definition for the vulnerability is CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space. Passing the stale mapping to folio_migrate_mapping() makes it use the mapped-folio path for a folio that is no longer in swapcache. It can then operate on swap_space.i_pages with invalid reference accounting, eventually triggering a folio reference count BUG. After a successful split, nr still contains the number of pages in the original large folio, although each resulting page is now a separate order-0 folio. Reset nr to 1 so each split folio is processed separately, including its own swapcache removal and mapping lookup. Refresh the saved mapping after folio_free_swap() so the current folio state is used during migration.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-89755 since 09/11/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/11/2026).

Upgrading to version 7.2.4 or 7.3-rc1 eliminates this vulnerability. Applying the patch 8ffedc6573a665cdc31ebe47eae7b32b78d0df83/34a00895d032a414830d41106a09329ae6c251b6 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion