Vulnerability-Lookup

GHSA-JQWW-WR6J-993J

Vulnerability from github – Published: 2026-06-08 18:31 – Updated: 2026-06-14 06:30

Details

In the Linux kernel, the following vulnerability has been resolved:

mm/zone_device: do not touch device folio after calling ->folio_free()

The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-46277"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-08T17:16:45Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/zone_device: do not touch device folio after calling -\u003efolio_free()\n\nThe contents of a device folio can immediately change after calling\n-\u003efolio_free(), as the folio may be reallocated by a driver with a\ndifferent order.  Instead of touching the folio again to extract the\npgmap, use the local stack variable when calling percpu_ref_put_many().",
  "id": "GHSA-jqww-wr6j-993j",
  "modified": "2026-06-14T06:30:23Z",
  "published": "2026-06-08T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46277"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-46277 (GCVE-0-2026-46277)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:41 – Updated: 2026-08-05 12:30

Title

mm/zone_device: do not touch device folio after calling ->folio_free()

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/85be0a262e39c706e…
https://git.kernel.org/stable/c/39928984956037cab…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d245f9b4ab806733a77e51a218ca7b8bc3135cd9 , < 85be0a262e39c706edb53c88af8afde2e98222ba (git) Affected: d245f9b4ab806733a77e51a218ca7b8bc3135cd9 , < 39928984956037cabd304321cb8f342e47421db5 (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "85be0a262e39c706edb53c88af8afde2e98222ba",
              "status": "affected",
              "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
              "versionType": "git"
            },
            {
              "lessThan": "39928984956037cabd304321cb8f342e47421db5",
              "status": "affected",
              "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/zone_device: do not touch device folio after calling -\u003efolio_free()\n\nThe contents of a device folio can immediately change after calling\n-\u003efolio_free(), as the folio may be reallocated by a driver with a\ndifferent order.  Instead of touching the folio again to extract the\npgmap, use the local stack variable when calling percpu_ref_put_many()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only when a ZONE_DEVICE folio is freed via `__folio_put()` \u2192 `free_zone_device_folio()`, which occurs during device-private memory migration teardown (e.g. `migrate_vma_finalize()` \u2192 `folio_put()` on source folios). That path is driven by local process activity\u2014mmap, CPU page faults on GPU-resident memory, and concurrent GPU allocation\u2014not by remote network packet handling.\nAC:L - Exploitation requires winning a race between `-\u003efolio_free()` returning a folio to a driver free list and `percpu_ref_put_many()` re-reading `folio-\u003epgmap`, but an attacker can control both sides by running concurrent GPU migration and allocation threads on the same device. No conditions outside attacker influence (specific memory layout, victim state) are required beyond normal GPU workload timing.\nPR:L - Triggering device-private folio migration and free requires only an unprivileged local user with access to a GPU render node (e.g. `/dev/dri/renderD*`, typically granted via the `render` group), not real root in the init namespace. No CAP_SYS_ADMIN or other elevated capability is needed to exercise the migrate/fault/alloc paths that reach `free_zone_device_folio()`.\nUI:N - Exploitation is fully automatable through GPU compute or graphics workloads that migrate memory between system RAM and device-private VRAM; no victim click, mount, or other deliberate interactive action beyond the attacker running their own program is required.\nS:U - Successful exploitation corrupts kernel memory and `dev_pagemap` refcounts to achieve kernel privilege escalation within the host kernel security boundary. It does not inherently cross a VM/host or IOMMU/DMA isolation boundary, even though GPU cloud tenants are a plausible deployment scenario.\nC:H - After `-\u003efolio_free()`, the folio may be immediately reallocated and its metadata overwritten; reading `folio-\u003epgmap` afterward is a use-after-free that can dereference attacker-influenced or stale pointers. Wrong `percpu_ref` targets can also cause premature `pgmap` teardown, enabling further kernel memory disclosure.\nI:H - Calling `percpu_ref_put_many()` on a corrupted or wrong `pgmap-\u003eref` (potentially with a large `nr` from a huge folio) corrupts kernel refcount state and adjacent memory, which is a standard path to arbitrary kernel write and control-flow hijack, not merely a bounded data change.\nA:H - Incorrect `percpu_ref_put_many()` on a stale or wrong `pgmap` can underflow refcounts, trigger use-after-free of `dev_pagemap`, or cause immediate kernel BUG/WARN/oops during memory teardown. Even without full exploit development, the bug reliably threatens kernel crashes and denial of service during device folio free."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:59.977Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5"
        }
      ],
      "title": "mm/zone_device: do not touch device folio after calling -\u003efolio_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46277",
    "datePublished": "2026-06-08T15:41:19.760Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:59.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.