CVE-2026-46268: Linux Kernel P2PDMA Memory Allocation Warning Logic Error

Technical summary

CVE-2026-46268 involves a logic error in the p2pmem_alloc_mmap() function within drivers/pci/p2pdma.c. Commit b7e282378773 modified the initial page reference count for P2PDMA memory from 1 to 0, but the function retained a VM_WARN_ON_ONCE_PAGE() assertion that expects the refcount to be zero, creating a contradictory condition. When CONFIG_DEBUG_VM is enabled at kernel compile time, the assertion fires incorrectly, dumping verbose page metadata warnings to the kernel log. The fix corrects the assertion logic to match the actual initialized state.

Business impact

The primary impact is operational noise rather than security compromise. Systems running debug-enabled kernels with P2P DMA workloads will experience kernel log spam, increased I/O on logging infrastructure, and potential false positives in automated monitoring systems. In large-scale deployments or containerized environments where kernel logs are aggregated, this can increase storage costs and obscure genuine security or performance events. The issue does not directly compromise data confidentiality or integrity, nor does it enable privilege escalation.

Affected systems

Linux kernel versions between commit b7e282378773 and the fix are affected. The vulnerability manifests only when: (1) the kernel is compiled with CONFIG_DEBUG_VM enabled (common in development and some hardened distributions), and (2) P2PDMA functionality is in use (typically in high-performance computing, storage offload, or GPU environments). Standard production kernels without debug VM checks are unaffected by the warning, though the underlying code path logic issue persists.

Exploitability

This vulnerability is not exploitable for remote code execution, privilege escalation, or data exfiltration. It does not trigger a crash, panic, or denial of service in practice. The warning is self-contained and does not corrupt memory or allow attackers to influence control flow. No exploit code or specific triggering conditions beyond normal P2PDMA allocation operations are required to observe the symptom—it manifests as a side effect of correct operation under debug configurations.

Remediation

The fix involves replacing the negated assertion condition with the correct positive condition: change VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) to VM_WARN_ON_ONCE_PAGE(page_ref_count(page)) to match the post-b7e282378773 page initialization behavior. This is a one-line code correction in the assertion logic and carries minimal risk of introducing new issues. The functional behavior of P2PDMA allocation remains unchanged.

Patch guidance

Apply the corrected assertion condition to the p2pmem_alloc_mmap() function in drivers/pci/p2pdma.c. Verify against the Linux kernel's official repository and stable branch advisories for the exact version containing this fix. Users running debug-enabled kernels (CONFIG_DEBUG_VM=y) should prioritize this patch to reduce log noise and improve observability. Standard production kernel deployments should assess whether P2PDMA is in active use before scheduling; if P2PDMA is not utilized, the impact is none.

Detection guidance

Monitor kernel logs for repeated 'VM_WARN_ON_ONCE_PAGE(!page_ref_count(page))' warnings originating from drivers/pci/p2pdma.c:240 on systems with CONFIG_DEBUG_VM enabled. Correlation with P2PDMA workload initiation (e.g., GPU pass-through setup, storage offload job submission) confirms the issue. Collect affected kernel version, CONFIG_DEBUG_VM status, and P2PDMA usage context. This does not require active security monitoring—standard kernel log review or grepping for the warning pattern suffices.

Why prioritize this

This receives a MEDIUM severity score due to availability impact (degraded observability, log flooding) rather than confidentiality or integrity compromise. It is a quality/reliability issue rather than a true security vulnerability, but it merits timely remediation because it can trigger false alarms and obscure genuine security events in monitored environments. Prioritize for debug-enabled production systems or development clusters; deprioritize for standard production deployments not using P2PDMA.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector: Local (AV:L—kernel-level issue, no remote trigger), Access Complexity: Low (AC:L—normal P2PDMA operations trigger the condition), Privileges Required: Low (PR:L—non-root users can trigger P2PDMA allocation), User Interaction: None (UI:N—automatic upon operation), Scope: Unchanged (S:U—no cross-boundary impact), Confidentiality: None (C:N), Integrity: None (I:N), and Availability: High (A:H—log flooding and monitoring disruption). The score penalizes the observability impact without inflating the rating due to the absence of code execution or crash risk.

Frequently asked questions