CVE-2026-46280: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46280 Overview

CVE-2026-46280 is a use-after-free vulnerability in the Linux kernel's Heterogeneous Memory Management (HMM) selftest module (lib/test_hmm). The flaw resides in the dmirror_fops_release() function, which frees the dmirror struct without first migrating device private pages back to system memory. Pages retain a dangling zone_device_data pointer to the freed structure.

A subsequent fault on those pages, such as during a coredump, causes the dmirror_devmem_fault() callback to dereference the stale pointer and triggers a kernel panic. The issue was reproduced on arm64 while running mm/ksft_hmm.sh selftests.

Critical Impact
A stale zone_device_data pointer can be dereferenced after release, causing kernel panic and denial of service on systems running the HMM selftest module.

Affected Products

Linux kernel builds that include the lib/test_hmm HMM selftest module (CONFIG_TEST_HMM)
Stable kernel branches referenced by the upstream fix commits
Systems exercising HMM device private memory through the test_hmm driver

Discovery Timeline

2026-06-08 - CVE-2026-46280 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46280

Vulnerability Analysis

The test_hmm module emulates a device with private memory to exercise the kernel's HMM subsystem. Each allocated device private page stores a back-pointer in zone_device_data that references the owning dmirror instance.

When userspace closes the file descriptor, dmirror_fops_release() frees the dmirror struct directly. The function does not first migrate device private pages back to system memory, so the pages outlive their owner with pointers into freed memory.

Any later fault on those pages invokes dmirror_devmem_fault(), which dereferences the stale zone_device_data pointer. The original report observed this during coredump handling on arm64, where a test failure caused SIGABRT and the core writer walked VMAs containing the orphaned device private pages, panicking the kernel.

Root Cause

The root cause is missing teardown of device private memory during file release [CWE-416 Use After Free]. The release path frees the owning structure while leaving page metadata that still references it, violating the lifetime contract between dmirror and its device pages.

Attack Vector

Exploitation requires local access to a system where the test_hmm selftest module is loaded. An unprivileged process that can open the test_hmm character device, allocate device private pages, close the file descriptor, and then fault on those pages can crash the kernel. The vector is local denial of service; no remote trigger exists.

No verified public exploit code is available. The vulnerability manifests in the device memory release path. Consult the upstream commits listed in the references for the exact fix, which calls dmirror_device_evict_chunk() for each devmem chunk during dmirror_fops_release() to migrate pages back to system memory before freeing the dmirror struct.

Detection Methods for CVE-2026-46280

Indicators of Compromise

Kernel panic stack traces referencing dmirror_devmem_fault or zone_device_data access
Crashes during coredump generation on processes that used the test_hmm device
Failures from mm/ksft_hmm.sh selftest runs followed by kernel oops messages

Detection Strategies

Audit kernel build configurations for CONFIG_TEST_HMM=y or =m on production systems, where the module should not be present
Review dmesg and /var/log/kern.log for BUG: KASAN: use-after-free reports involving HMM symbols
Run the kernel with KASAN enabled in test environments to catch the dangling pointer dereference before it causes a panic

Monitoring Recommendations

Collect kernel crash dumps with kdump and inspect backtraces for HMM-related frames
Forward kernel logs to a centralized log platform and alert on panic strings containing dmirror_* symbols
Track loaded kernel modules across the fleet and flag any host where test_hmm appears in lsmod output

How to Mitigate CVE-2026-46280

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commits, which add dmirror_device_evict_chunk() calls in dmirror_fops_release()
Remove or unload the test_hmm module from any production system where it is not required
Rebuild custom kernels without CONFIG_TEST_HMM unless HMM selftests are actively in use

Patch Information

The fix is distributed across multiple stable kernel branches. Reference the upstream commits: Kernel Commit 38f113f8, Kernel Commit 5846715b, Kernel Commit 744dd977, Kernel Commit 9de1eb0a, and Kernel Commit bf477abd. The fix moves dmirror_device_evict_chunk() earlier in the file and invokes it for each devmem chunk before the struct is freed.

Workarounds

Restrict access to the test_hmm character device by tightening permissions on /dev/hmm_dmirror* nodes
Blacklist the test_hmm module via /etc/modprobe.d/blacklist.conf on systems that do not require HMM selftests
Disable coredump generation for processes that interact with the test_hmm device using ulimit -c 0 or prctl(PR_SET_DUMPABLE, 0)

bash

# Configuration example
echo 'blacklist test_hmm' | sudo tee /etc/modprobe.d/disable-test-hmm.conf
sudo modprobe -r test_hmm 2>/dev/null || true
lsmod | grep -i test_hmm