CVE-2026-46280: Linux Kernel HMM Use-After-Free in Device Memory Handling

Technical summary

CVE-2026-46280 is a use-after-free vulnerability in lib/test_hmm.c. The dmirror_fops_release() function frees the dmirror struct without first migrating device private pages (marked with zone_device_data pointers) back to system memory. When a subsequent page fault occurs on these device pages—particularly during coredump processing—the dmirror_devmem_fault() callback dereferences a stale pointer to the freed dmirror struct, triggering a kernel panic. The fix involves invoking dmirror_device_evict_chunk() during file release to ensure all device memory pages are evicted and migrated to system RAM before struct deallocation.

Business impact

This vulnerability affects systems running affected Linux kernel versions that utilize HMM features for GPU or accelerator memory management, particularly on ARM64 architectures. While triggered in a test module context, the underlying code patterns may affect production HMM implementations. The primary risk is unplanned kernel crashes during memory fault handling or system diagnostics (coredumps), which can cause service disruption and complicate post-incident analysis. Systems relying on HMM for heterogeneous compute workloads should prioritize remediation to prevent crash-induced downtime.

Affected systems

The vulnerability resides in the Linux kernel HMM test module (lib/test_hmm.c) and affects Linux kernel versions containing this code path. ARM64 systems running automated HMM tests are confirmed vulnerable. Any production kernel with similar HMM memory management patterns in user-facing code could be at risk, though the reported vector is specifically the testing harness. Desktop, server, and embedded systems running vulnerable kernel versions are in scope.

Exploitability

Exploitation requires local access to trigger the vulnerability, as indicated by the CVSS vector (AV:L, PR:L). An authenticated local user must interact with the HMM test module (or equivalent production code) in a way that causes device pages to persist after file closure, followed by a fault condition (coredump, page migration, or memory access). The crash is not easily triggered in typical workloads but reliably reproduces during test execution or system diagnostics. No remote exploitation path exists.

Remediation

Apply the kernel patch that modifies dmirror_fops_release() to call dmirror_device_evict_chunk() for each device memory chunk prior to freeing the dmirror struct. This ensures all device private pages are migrated back to system memory, eliminating dangling pointers. The patch also relocates dmirror_device_evict_chunk() earlier in the file to avoid forward declaration. Verify the fix against the Linux kernel stable branches corresponding to your deployed versions.

Patch guidance

Identify your Linux kernel version and check the upstream kernel repository for the HMM test module fix (part of a 3-patch series addressing HMM test issues). Backports may be available for stable and LTS branches. Testing on ARM64 systems is recommended given the platform-specific reproduction conditions. Validate that the patch includes the eviction call in dmirror_fops_release() and that device pages are properly migrated before struct deallocation.

Detection guidance

Monitor kernel logs for page fault panics referencing dmirror_devmem_fault() or zone_device_data corruption, especially following test execution or coredump generation. If HMM is active on your systems, audit for use of lib/test_hmm module in production—it should only be present in test/development environments. Enable kernel debugging (CONFIG_DEBUG_PAGEALLOC, CONFIG_KASAN) in test environments to catch use-after-free earlier. Check for kernel crashes with stack traces mentioning dev_pagemap or device private page handling.

Why prioritize this

A CVSS 7.8 HIGH severity local use-after-free vulnerability warrants prompt attention, particularly for ARM64 infrastructure and any systems where HMM is actively used. While exploitation requires local access and specific trigger conditions, the consequence—kernel panic—is severe for availability and incident response workflows. The narrow attack surface (local, authenticated) and test-module origin reduce business risk for production deployments, but systems with HMM enabled or running kernel selftests should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local vulnerability with low attack complexity, requiring low privilege and no user interaction. The impact is complete across confidentiality, integrity, and availability due to the kernel panic and potential memory corruption. The scope is unchanged (local only). The score is appropriate given the severity of kernel crashes but appropriately discounted by the local-only attack vector.

Frequently asked questions