CVE-2026-45880: Linux Kernel Privilege Escalation Flaw

CVE-2026-45880 Overview

CVE-2026-45880 is a resource management flaw in the Linux kernel's PCI Peer-to-Peer Direct Memory Access (P2PDMA) subsystem. The vulnerability resides in the p2pmem_alloc_mmap() function, which fails to release a per-CPU reference to the pgmap structure when vm_insert_page() returns an error. The leaked reference prevents memunmap_pages() from completing, causing it to hang indefinitely when the associated PCI device is removed.

The issue affects systems that expose P2PDMA memory through memory-mapped I/O interfaces. A failed page insertion leaves the kernel in a state where PCI device teardown cannot proceed, resulting in a denial of service condition on the host.

Critical Impact
A failed vm_insert_page() call in the P2PDMA mmap path leaks a per-CPU pgmap reference, hanging memunmap_pages() and blocking PCI device removal.

Affected Products

Linux kernel versions containing the PCI/P2PDMA p2pmem_alloc_mmap() implementation prior to the fix
Distributions shipping affected stable kernel branches referenced in the upstream commits
Systems exposing P2PDMA memory regions to userspace via mmap

Discovery Timeline

2026-05-27 - CVE-2026-45880 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45880

Vulnerability Analysis

The Linux kernel's P2PDMA subsystem allows PCI devices to exchange data directly without routing transfers through system memory. The p2pmem_alloc_mmap() function maps P2P memory into a user process's address space. During this operation, the kernel acquires a per-CPU reference on the associated pgmap via gen_pool_alloc_owner() and then calls vm_insert_page() to install the page in the process's virtual memory area.

When vm_insert_page() fails, the original code path returns without invoking percpu_ref_put() to drop the acquired reference. The reference remains held for the lifetime of the kernel instance. Any subsequent attempt to tear down the P2PDMA region through memunmap_pages() waits for the reference count to drain and never returns.

Root Cause

The root cause is a missing reference release on an error path, a class of bug related to resource leak handling. The acquire-and-release contract for the pgmap per-CPU reference was incomplete: gen_pool_alloc_owner() increments the reference, but the failure branch in p2pmem_alloc_mmap() does not call the matching percpu_ref_put(). The fix adds the missing percpu_ref_put() so the reference is balanced regardless of whether vm_insert_page() succeeds.

Attack Vector

The vulnerability is triggered when vm_insert_page() fails during a P2PDMA mmap operation. Conditions that lead to such failures include memory pressure, invalid mapping requests, or address space constraints in the calling process. A local user with access to a P2PDMA-capable character device can repeatedly attempt mmap operations under conditions that induce vm_insert_page() failures.

The consequence is not arbitrary code execution but a hung kernel path: once the leak occurs, removing or unbinding the underlying PCI device hangs memunmap_pages() indefinitely. Administrators lose the ability to cleanly remove the device, and dependent operations such as hot-unplug, driver unload, and system suspend can stall.

No verified public exploit code is available. The upstream fix is documented in the kernel commits referenced below, and the vulnerability mechanism can be reviewed in the patch series.

Detection Methods for CVE-2026-45880

Indicators of Compromise

Kernel tasks blocked in memunmap_pages() or wait_for_completion() during PCI device removal, visible in /proc/<pid>/stack or dmesg hung task warnings
echo 1 > /sys/bus/pci/devices/<dev>/remove commands that never return
Repeated vm_insert_page failures in kernel logs preceding stalled device teardown

Detection Strategies

Audit running kernel versions against the fixed commits (51b7181, 6220694, a1f4dc7, baa42b7, e19cce8) on affected stable branches
Monitor kernel hung-task detector output for stacks containing memunmap_pages or percpu_ref_kill symbols
Track PCI hotplug and driver unbind operations that exceed expected completion windows

Monitoring Recommendations

Enable CONFIG_DETECT_HUNG_TASK and forward khungtaskd warnings to a centralized log pipeline
Alert on processes performing mmap on P2PDMA character devices followed by device removal failures
Collect kernel stack traces during PCI subsystem anomalies for retrospective analysis

How to Mitigate CVE-2026-45880

Immediate Actions Required

Apply the upstream kernel patch that adds the missing percpu_ref_put() in p2pmem_alloc_mmap() on the vm_insert_page() failure path
Update to a stable kernel release that includes one of the fix commits listed in the references
Restrict access to P2PDMA-capable device nodes to trusted users until the patch is deployed

Patch Information

The fix has been merged into the upstream Linux kernel and backported to multiple stable branches. The relevant commits are Linux Kernel Commit 51b7181, Linux Kernel Commit 6220694, Linux Kernel Commit a1f4dc7, Linux Kernel Commit baa42b7, and Linux Kernel Commit e19cce8. Rebuild and reboot into the patched kernel to remediate the issue.

Workarounds

Disable or refrain from using P2PDMA mmap interfaces on workloads that do not require them
Tighten file permissions on P2PDMA character devices to prevent unprivileged users from invoking the vulnerable mmap path
Avoid PCI device removal operations on hosts where the leak may have already occurred and schedule a reboot to clear the leaked references

bash

# Verify the running kernel version and check for the fix
uname -r

# Restrict access to P2PDMA device nodes (example path)
chmod 600 /dev/p2pmem*
chown root:root /dev/p2pmem*

# Enable hung task detection to surface stalled memunmap_pages calls
sysctl -w kernel.hung_task_timeout_secs=120
sysctl -w kernel.hung_task_warnings=10