CVE-2026-93284

A flaw was found in the Linux kernel's DRM (Direct Rendering Manager) pagemap subsystem. During page migration error handling, the kernel clears the page tracking array before finishing Direct Memory Access (DMA) unmapping operations. A local user could exploit this flaw by triggering migration failures, causing improper memory unmapping and leading to a system crash and Denial of Service (DoS).

A moderate-impact flaw was found in the Linux kernel's DRM (Direct Rendering Manager) pagemap subsystem. drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping, but when handling page migration errors drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving the kernel with no valid page information and resulting in improper DMA unmapping. A local user with access to a DRM device could exploit this flaw by triggering page migration failures, causing a system crash and denial of service.

The vulnerable code was introduced into Red Hat kernels through the upstream v6.16..v6.17 DRM merge, so only newer streams contain it: Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10), Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform 4.22, 4.23, 5.0 and 5.1 (ose-rhel-coreos-9). Red Hat Enterprise Linux 6, 7 and 8, the earlier RHEL 9 (rhel-9.2, rhel-9.4, rhel-9.6) and RHEL 10.0 streams, the kernel-rt builds, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in those kernels.

Red Hat rates this flaw Moderate (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges and impacts only system availability; this differs from the CVE.org score of 8.8, which assumes scope change and confidentiality and integrity impact that the available technical evidence does not establish. Fixes for the affected streams are currently deferred; the residual risk is that a local user able to trigger DRM page migration failures could crash the system and cause denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.