CVE-2026-90391
kernel: lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel. A local user could exploit a vulnerability in the dmirror_fault() function. When a mirrored memory management (mm) structure has exited, dmirror_fault() incorrectly returns a success code, causing the caller to enter an infinite retry loop. This can lead to a Denial of Service (DoS) condition, making the system unresponsive.
Statement
This flaw is rated with a Low severity because it is confined to a kernel test driver that is not utilized during standard production operations. To trigger the condition, a local attacker requires access to the test driver interface during process termination, potentially causing an endless loop that impacts availability. Standard Red Hat Enterprise Linux deployments do not load or expose this test module by default, significantly limiting real-world exposure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')