CVE-2026-53155: Linux Kernel Device-Private Memory Corruption Leading to Denial of Service

Technical summary

CVE-2026-53155 is a logic error in set_pmd_migration_entry() within mm/huge_memory.c. The function uses incorrect flag-checking functions (pmd_write(), pmd_soft_dirty(), pmd_uffd_wp()) on device-private PMD entries when they should use entry-specific accessors. On x86-64, _PAGE_SWP_SOFT_DIRTY is aliased to _PAGE_RW, so pmd_write() misinterprets the soft-dirty bit as the write bit when CONFIG_MEM_SOFT_DIRTY is enabled. This causes migration entries to be marked writable when they should be read-only, corrupting the folio's AnonExclusive refcount state. The resulting entire_mapcount mismatch triggers a VM_WARN_ON_FOLIO assertion in __folio_add_anon_rmap(), causing a kernel panic. The bug is exposed by fork + device-private THP migration patterns in workloads like the hmm_device_private.anon_write_child selftest.

Business impact

This vulnerability affects Linux systems running HPC, AI/ML, or GPU-accelerated workloads that use device-private memory migration APIs. A local unprivileged user can crash the kernel without requiring elevated privileges, resulting in denial of service. Systems without such workloads or device-private memory configurations are not affected. The crash is deterministic under the right memory migration sequence, making it reliably exploitable in multi-process GPU or accelerator applications.

Affected systems

The Linux kernel across all versions implementing device-private memory support and the rmap/migration changes introduced in commits 65edfda6f3f2 and 775465fd26a3. Affected configurations include systems with GPUs or other devices using the HMM (Heterogeneous Memory Management) API with transparent huge pages (THP) enabled. ARM64, x86-64, and other architectures are affected. Distributions shipping recent Linux kernels with GPU acceleration support (NVIDIA, AMD, Intel) or HPC accelerator drivers are at risk.

Exploitability

Exploitability is medium. A local unprivileged user can reliably trigger the kernel crash by executing memory migration patterns involving device-private memory and fork operations. No network access or special privileges are required. Exploitation requires a system with device-private memory support enabled (not default in many configs) and active workloads using the HMM API. The vulnerability is deterministic given the right sequence, but relies on specific memory migration scenarios, making opportunistic exploitation less likely than targeted attacks against known HPC/GPU deployments.

Remediation

Kernel updates implementing the fix to set_pmd_migration_entry() are required. The patch corrects the function to use appropriate softleaf entry accessors instead of pmd_* functions, and conditionally updates A/D flags only for present entries. Linux maintainers should apply the referenced fix immediately to stable and LTS branches. Verify the patch against the upstream kernel repository and vendor advisories for your distribution.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates that address CVE-2026-53155. The fix involves correcting set_pmd_migration_entry() logic and is typically backported to stable kernels. Apply kernel updates as soon as patches are available from your vendor (Red Hat, Canonical, SUSE, etc.). If your systems do not use device-private memory migration (i.e., no GPU/accelerator workloads), patch priority may be lower, but is still recommended for defense-in-depth. Verify kernel version post-patch against vendor release notes; no workarounds exist without patching the kernel source.

Detection guidance

Monitor system logs and kernel message buffers for VM_WARN_ON_FOLIO assertions or BUG/panic messages originating from __folio_add_anon_rmap() or migration code paths. The assertion message will reference folio_entire_mapcount() mismatch with AnonExclusive state. Enable kernel debugging (CONFIG_DEBUG_VM) in test/staging environments to catch the warning before panic. In production, enable kernel crash dumps (kdump) to capture the assertion context. Log aggregation and alerting on kernel panic events is essential for detecting exploitation attempts.

Why prioritize this

Although rated CVSS 5.5 (Medium), this vulnerability should be prioritized if your infrastructure includes GPU-accelerated or HPC workloads using device-private memory. The availability impact is severe—a local user can reliably crash the kernel—and the attack surface is expanding as GPU/accelerator adoption grows. Organizations running NVIDIA CUDA, AMD ROCm, Intel DPL, or OpenCL workloads should prioritize patching. For general-purpose server deployments without accelerator support, priority can be deferred but should not be ignored indefinitely.

Risk score, explained

CVSS 5.5 reflects a local-only attack vector (AV:L), low complexity (AC:L), requiring low privilege (PR:L), with no user interaction, affecting only availability (A:H). The absence of confidentiality and integrity impacts keeps the score moderate. However, the practical impact is high for affected deployments: a single unprivileged process can instantly down the system. The rating appropriately penalizes the local-only requirement but does not fully capture the severity of deterministic kernel crashes in production GPU/HPC clusters.

Frequently asked questions