CVE-2026-46280

A flaw was found in the Linux kernel's Heterogeneous Memory Management (HMM) test module. When a device mirror (dmirror) structure is freed, its associated device private pages are not properly migrated back to system memory. This can lead to a use-after-free condition where a dangling pointer to the freed dmirror is dereferenced, potentially causing a kernel panic. A local attacker could exploit this to trigger a denial of service.

lib/test_hmm can leave device private pages with a stale zone_device_data pointer after dmirror_fops_release frees the dmirror object without first migrating those pages back to system memory. A later fault on the same pages, for example during coredump VMA walking after SIGABRT in the HMM selftest, can call dmirror_devmem_fault and dereference the freed dmirror pointer. For the CVSS the PR:L is used in the paranoid score because a local user or test process with access to the HMM test device may be enough once the test module is present, even though loading the module and configuring the test environment is usually administrative. The issue is not network reachable. Impact is at least local denial of service via kernel crash. Because this is a real use-after-free on a kernel pointer, worst case confidentiality and integrity impact are plausible and the case should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.