{"id":"CVE-2026-68163","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-68163","summary":"mm/page_vma_mapped: fix device-private PMD handling","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_vma_mapped: fix device-private PMD handling\n\nCommit 65edfda6f3f2 (\"mm/rmap: extend rmap and migration support\ndevice-private entries\") introduced the concept of device-private PMD\nentries, but did not correctly update the rmap walk code to account for\nthem.\n\nAs a result, when page_vma_mapped_walk() encounters device-private PMD\nentries, it takes no action other than to acquire the PMD lock and exit.\n\nHowever this is highly problematic for two reasons - firstly, device\nprivate entries possess a PFN so check_pmd() needs to be called to ensure\nan overlapping PFN range.\n\nSecondly, and more importantly, if PVMW_MIGRATION is set the caller\nassumes the returned entry is a migration entry, resulting in memory\ncorruption when the caller tries to interpret the device private entry as\nsuch.\n\nIn addition, commit 146287290023 (\"mm/huge_memory: implement\ndevice-private THP splitting\") allowed device private PMDs to be split\nlike THP mappings, but again did not update this code path.\n\nAs a result, we might race a PMD split prior to acquiring the PMD lock.\n\nThis patch addresses all of these issues by invoking check_pmd(), ensuring\nPMVW_MIGRATION is not set and checks whether a split raced us we do for\nPMD THP and migration entries.\n\nInstead of checking for a subset of the cases after taking the pmd_lock(),\nput device-private along with pmd_trans_huge() and\npmd_is_migration_entry().  Also remove thp_migration_supported() as it is\nalready guarded by pmd_is_migration_entry().\n\n[akpm@linux-foundation.org: fix Raspberry Pi 1 build, per David]","published":"2026-08-10T11:59:30.633Z","modified":"2026-08-14T04:03:55.729499943Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"7.1.6"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/ab6209f4b48a98ef14d6766acdb62aa9bb32e670"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f84ca9b1888d8fce7dfefe0e750fa971f8797486"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68163.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68163"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-14T04:03:55.729499943Z"}}