CVE-2026-89758

A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit (GPU) driver migrates a Transparent Huge Page (THP) to device memory, it can leave a device-private Page Middle Directory (PMD) entry. If a user-space application then attempts to manage this memory range, the kernel may incorrectly process the non-present PMD, leading to a system crash. This vulnerability could allow a local attacker to cause a Denial of Service (DoS).

A MODERATE impact flaw was found in the Linux kernel's memory management (mempolicy) subsystem. When an HMM-based GPU driver migrates an anonymous Transparent Huge Page (THP) folio to device memory via migrate_vma_pages(), a device-private PMD entry can be left in the process page tables. Because pmd_is_huge() returns true for any non-present, non-none huge PMD, queue_folios_pmd() can be reached with such a PMD and pass it to pmd_folio(), which treats the softleaf encoding as a hardware PFN and can return a bogus folio pointer. A local low-privileged user who subsequently calls mbind(), migrate_pages(), or set_mempolicy_home_node() on that address range can trigger a kernel oops, a VM_BUG_ON() on debug kernels, or silent isolation of an unrelated live folio from the LRU, resulting in a denial of service (system crash). The vulnerable code was introduced upstream in Linux v6.19 and is not present in the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels, so those products are marked not affected. Only the OpenShift Container Platform 5.0 and 5.1 RHCOS streams are affected; the fix for those streams is currently deferred, leaving residual risk of a local denial of service on systems where an HMM-based GPU driver migrates THP folios to device memory. Red Hat rates this flaw with high attack complexity (CVSS 3.1 score 7.0) versus the upstream CVEORG score of 7.8 with low attack complexity, because exploitation requires the specific precondition of a device-private PMD left behind by an HMM-based GPU driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.