CVE-2026-46277 Overview
CVE-2026-46277 is a use-after-free vulnerability in the Linux kernel's mm/zone_device memory management subsystem. The flaw resides in the handling of device folios after invoking the ->folio_free() callback. After the callback completes, a driver may immediately reallocate the folio with a different order, making any subsequent access to its contents unsafe. The kernel community has resolved the issue by avoiding access to the folio after the free callback and instead using a local stack variable to call percpu_ref_put_many().
Critical Impact
Improper access to a device folio after ->folio_free() can result in memory corruption or kernel instability when the folio is reallocated by a driver with a different order.
Affected Products
- Linux kernel (mainline mm/zone_device subsystem)
- Stable kernel branches referenced in upstream commits 3992898495603 and 85be0a262e39
- Distributions shipping the affected mm/zone_device code prior to the upstream fix
Discovery Timeline
- 2026-06-08 - CVE-2026-46277 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-46277
Vulnerability Analysis
The vulnerability exists in the Linux kernel mm/zone_device code path that releases device-managed folios. When the kernel invokes the driver-supplied ->folio_free() callback, ownership of the folio is effectively returned to the device driver. The driver is free to reuse, reallocate, or split that folio with a different order at any time.
The pre-patch code re-read fields from the folio after the callback returned in order to extract the pgmap pointer for the subsequent percpu_ref_put_many() call. Because the folio's contents may already have changed, this read operates on stale or attacker-influenced memory. The result is a classic use-after-free condition in kernel memory management code [CWE-416].
Root Cause
The root cause is a lifetime violation. The code assumed the folio metadata remained valid after ->folio_free() returned, but the contract permits drivers to reallocate the folio immediately. Reading the pgmap field from such a folio produces undefined behavior. The upstream fix caches the pgmap pointer in a local stack variable before calling ->folio_free(), then uses that stack copy for the reference count decrement.
Attack Vector
Local attack vectors are required because triggering the race involves device folio reallocation paths driven by kernel subsystems such as device memory (DEVICE_PRIVATE, DEVICE_COHERENT) and HMM. An attacker would need to influence allocation patterns through a driver that exposes device memory to user space. Successful exploitation could lead to kernel memory corruption or denial of service through kernel panic. The NVD entry does not list an authoritative CVSS score, and EPSS data indicates a low predicted exploitation probability at this time.
No verified proof-of-concept code is available. The vulnerability mechanism is described in the upstream commits referenced in the Linux Kernel Commit Note (39928984956037cabd304321cb8f342e47421db5) and the Linux Kernel Commit Note (85be0a262e39c706edb53c88af8afde2e98222ba).
Detection Methods for CVE-2026-46277
Indicators of Compromise
- Kernel oops or panic traces referencing zone_device, folio_free, or percpu_ref_put_many in dmesg output.
- KASAN reports flagging use-after-free reads in the device folio release path.
- Unexpected reference count imbalances on dev_pagemap (pgmap) structures.
Detection Strategies
- Enable KASAN and KFENCE in test kernels to surface use-after-free reads on device folios during workload stress.
- Inventory running kernel versions across Linux fleets and compare against the patched stable releases referenced in the upstream commits.
- Correlate kernel crash telemetry with workloads that exercise DEVICE_PRIVATE or HMM-backed memory.
Monitoring Recommendations
- Forward dmesg and kernel.log to centralized logging and alert on KASAN, BUG, or oops signatures involving zone_device.
- Track package versions of kernel, linux-image, and vendor kernel builds through configuration management tooling.
- Monitor crash dumps from systems running GPU, accelerator, or HMM-enabled drivers, which are most likely to exercise the affected code path.
How to Mitigate CVE-2026-46277
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in commits 3992898495603 and 85be0a262e39 as soon as distribution updates become available.
- Identify hosts that load drivers using DEVICE_PRIVATE, DEVICE_COHERENT, or HMM-backed memory and prioritize them for patching.
- Restrict local user access on systems where the patch cannot yet be applied.
Patch Information
The fix replaces the post-callback folio dereference with a cached local pointer to the pgmap. The patched code calls percpu_ref_put_many() using the stack variable captured before ->folio_free() is invoked. See the Linux Kernel Commit Note (39928984956037cabd304321cb8f342e47421db5) and the Linux Kernel Commit Note (85be0a262e39c706edb53c88af8afde2e98222ba) for the authoritative upstream changes.
Workarounds
- Avoid loading optional device drivers that rely on ZONE_DEVICE folios on unpatched hosts where feasible.
- Limit local account creation and enforce least privilege to reduce the local attack surface required to reach the vulnerable code path.
- Enable runtime kernel hardening features such as KASAN in non-production environments to detect related regressions early.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
