CVE-2026-46277 (GCVE-0-2026-46277)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:41 – Updated: 2026-08-05 12:30
VLAI
Title
mm/zone_device: do not touch device folio after calling ->folio_free()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d245f9b4ab806733a77e51a218ca7b8bc3135cd9 , < 85be0a262e39c706edb53c88af8afde2e98222ba (git)
Affected: d245f9b4ab806733a77e51a218ca7b8bc3135cd9 , < 39928984956037cabd304321cb8f342e47421db5 (git)
Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.0.4 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "85be0a262e39c706edb53c88af8afde2e98222ba",
              "status": "affected",
              "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
              "versionType": "git"
            },
            {
              "lessThan": "39928984956037cabd304321cb8f342e47421db5",
              "status": "affected",
              "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/zone_device: do not touch device folio after calling -\u003efolio_free()\n\nThe contents of a device folio can immediately change after calling\n-\u003efolio_free(), as the folio may be reallocated by a driver with a\ndifferent order.  Instead of touching the folio again to extract the\npgmap, use the local stack variable when calling percpu_ref_put_many()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only when a ZONE_DEVICE folio is freed via `__folio_put()` \u2192 `free_zone_device_folio()`, which occurs during device-private memory migration teardown (e.g. `migrate_vma_finalize()` \u2192 `folio_put()` on source folios). That path is driven by local process activity\u2014mmap, CPU page faults on GPU-resident memory, and concurrent GPU allocation\u2014not by remote network packet handling.\nAC:L - Exploitation requires winning a race between `-\u003efolio_free()` returning a folio to a driver free list and `percpu_ref_put_many()` re-reading `folio-\u003epgmap`, but an attacker can control both sides by running concurrent GPU migration and allocation threads on the same device. No conditions outside attacker influence (specific memory layout, victim state) are required beyond normal GPU workload timing.\nPR:L - Triggering device-private folio migration and free requires only an unprivileged local user with access to a GPU render node (e.g. `/dev/dri/renderD*`, typically granted via the `render` group), not real root in the init namespace. No CAP_SYS_ADMIN or other elevated capability is needed to exercise the migrate/fault/alloc paths that reach `free_zone_device_folio()`.\nUI:N - Exploitation is fully automatable through GPU compute or graphics workloads that migrate memory between system RAM and device-private VRAM; no victim click, mount, or other deliberate interactive action beyond the attacker running their own program is required.\nS:U - Successful exploitation corrupts kernel memory and `dev_pagemap` refcounts to achieve kernel privilege escalation within the host kernel security boundary. It does not inherently cross a VM/host or IOMMU/DMA isolation boundary, even though GPU cloud tenants are a plausible deployment scenario.\nC:H - After `-\u003efolio_free()`, the folio may be immediately reallocated and its metadata overwritten; reading `folio-\u003epgmap` afterward is a use-after-free that can dereference attacker-influenced or stale pointers. Wrong `percpu_ref` targets can also cause premature `pgmap` teardown, enabling further kernel memory disclosure.\nI:H - Calling `percpu_ref_put_many()` on a corrupted or wrong `pgmap-\u003eref` (potentially with a large `nr` from a huge folio) corrupts kernel refcount state and adjacent memory, which is a standard path to arbitrary kernel write and control-flow hijack, not merely a bounded data change.\nA:H - Incorrect `percpu_ref_put_many()` on a stale or wrong `pgmap` can underflow refcounts, trigger use-after-free of `dev_pagemap`, or cause immediate kernel BUG/WARN/oops during memory teardown. Even without full exploit development, the bug reliably threatens kernel crashes and denial of service during device folio free."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:59.977Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5"
        }
      ],
      "title": "mm/zone_device: do not touch device folio after calling -\u003efolio_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46277",
    "datePublished": "2026-06-08T15:41:19.760Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:59.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46277",
      "date": "2026-08-05",
      "epss": "0.0012",
      "percentile": "0.02187"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46277\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-08T17:16:45.277\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/zone_device: do not touch device folio after calling -\u003efolio_free()\\n\\nThe contents of a device folio can immediately change after calling\\n-\u003efolio_free(), as the folio may be reallocated by a driver with a\\ndifferent order.  Instead of touching the folio again to extract the\\npgmap, use the local stack variable when calling percpu_ref_put_many().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nmm/zone_device: no tocar el folio del dispositivo despu\u00e9s de llamar a -\u003efolio_free()\\n\\nEl contenido de un folio de dispositivo puede cambiar inmediatamente despu\u00e9s de llamar a -\u003efolio_free(), ya que el folio puede ser reasignado por un controlador con un orden diferente. En lugar de tocar el folio de nuevo para extraer el pgmap, usar la variable de pila local al llamar a percpu_ref_put_many().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/memremap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d245f9b4ab806733a77e51a218ca7b8bc3135cd9\",\"lessThan\":\"85be0a262e39c706edb53c88af8afde2e98222ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d245f9b4ab806733a77e51a218ca7b8bc3135cd9\",\"lessThan\":\"39928984956037cabd304321cb8f342e47421db5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/memremap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T06:37:17+00:00",
      "cve": "CVE-2026-46277",
      "id": "CVE-2026-46277",
      "initial_release_date": "2026-06-08T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/zone_device: do not touch device folio after calling -\u003efolio_free()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46277.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-15T01:21:18Z",
      "cve": "CVE-2026-46277",
      "id": "CVE-2026-46277",
      "initial_release_date": "2026-06-09T02:21:14Z",
      "product_status:known_not_affected": "291",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46277",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46277.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.