CVE-2026-46280
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, a use-after-free vulnerability was found in the HMM test (lib: test_hmm). When closing a file via dmirror_fops_release(), the dmirror struct is freed without first migrating device private pages back to system memory, leaving a dangling pointer. A subsequent page fault (e.g., during coredump) can dereference this stale pointer, causing a kernel panic.
Risk Assessment
The risk is a potential kernel panic during operations like coredump after a failed test, which can disrupt system operation and hinder diagnostics. The vulnerability only affects test environments with HMM tests enabled.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit from the 'Minor hmm_test fixes and cleanups' patch series). In production environments without HMM tests, the risk is minimal, but updating is recommended for code consistency.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages. Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration.