CVE-2026-93237

A flaw was found in the Linux kernel. An incorrect physical memory boundary check on LoongArch systems allows device memory allocations to fall outside the supported virtual memory mapping space. When the kernel attempts to map this out-of-bounds memory, an address wraparound occurs that silently corrupts kernel page tables. A local user could exploit this flaw during device memory operations to potentially achieve privilege escalation or cause a system crash resulting in a denial of service (DoS).

An incorrect physical memory search limit on LoongArch can allow get_free_mem_region or mhp_get_pluggable_range to select a ZONE_DEVICE range outside the vmemmap covered physical address space. The resulting address wraparound in vmemmap_populate can map the memmap range into low memory and silently corrupt kernel page tables. The direct observed impact includes crashes and failures during device memory initialization, while page table corruption may also permit confidentiality or integrity impact if an attacker can influence the affected allocation path. For the CVSS the PR:L value is used for the paranoid score because access to accelerator or device memory management may be delegated to a local user or service account in some deployments. Exploitation still requires a vulnerable LoongArch CPU configuration with fewer physical address bits, a compatible ZONE_DEVICE driver, and a triggering device memory operation, so AC:H is appropriate. The issue is not network reachable. Impact is at least a local denial of service and in the worst defensible case may include privilege escalation through page table corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.