CVE-2026-63953: Linux Kernel Information Disclosure Flaw

CVE-2026-63953 Overview

CVE-2026-63953 is a memory leak vulnerability in the Linux kernel's device migration subsystem. The flaw resides in the migrate_vma_insert_huge_pmd_page() function within mm/migrate_device. When the function jumps to the unlock_abort label after a Page Middle Directory (PMD) check failure, the page table allocated earlier via pte_alloc_one() is never released. This leaks kernel memory on each failed migration attempt.

The upstream fix adds a free_abort label that properly releases the pgtable in the error path. The issue affects kernel builds that include device memory migration for huge pages.

Critical Impact
Repeated invocation of the affected code path can gradually exhaust kernel memory, degrading system stability on hosts using device migration for GPU or accelerator workloads.

Affected Products

Linux kernel versions containing the migrate_vma_insert_huge_pmd_page() implementation prior to the fix commits
Distributions shipping the affected mm/migrate_device code
Systems using device driver migration paths (typically GPU and accelerator drivers)

Discovery Timeline

2026-07-19 - CVE-2026-63953 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63953

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the Linux memory management subsystem. Specifically, it affects the device-driven page migration logic that handles transparent huge pages at the PMD level.

The function migrate_vma_insert_huge_pmd_page() allocates a page table using pte_alloc_one() in preparation for installing a huge PMD entry. If a subsequent PMD sanity check fails, execution branches to the unlock_abort label. This path releases locks but does not free the previously allocated pgtable, leaving the allocation orphaned.

Each failed invocation permanently consumes one page-table page from kernel memory. On long-running systems that repeatedly trigger the abort path, kernel memory usage grows without bound.

Root Cause

The root cause is missing cleanup in an error-handling path. The unlock_abort label was designed to handle failure after lock acquisition but predates the pte_alloc_one() call that allocates the pgtable. The fix introduces a dedicated free_abort label that calls pte_free() on the allocated pgtable before proceeding to unlock and return.

Attack Vector

This vulnerability is not directly remotely exploitable and has no public exploit. Triggering the leak requires driver-mediated calls into the device migration path that repeatedly reach the PMD failure branch. Local workloads using accelerators such as GPUs with page migration enabled could unintentionally trigger the leak. The EPSS score for CVE-2026-63953 is 0.189%, indicating a very low probability of exploitation in the wild.

No weaponized code example exists. See the upstream commits 24861d04f197 and 2c6f81d58741 for the exact patch.

Detection Methods for CVE-2026-63953

Indicators of Compromise

Steady, unexplained growth in kernel slab memory attributed to page-table allocations on hosts running device migration workloads
Elevated PageTables counter in /proc/meminfo without a corresponding increase in user-space memory pressure
Kernel out-of-memory events on systems with heavy GPU or accelerator page-migration activity

Detection Strategies

Compare running kernel versions against the fixed commits 24861d04f197 and 2c6f81d58741 using package inventory data
Track nr_page_table_pages from /proc/vmstat over time and alert on sustained upward drift
Correlate device migration syscalls and driver activity with kernel memory growth trends

Monitoring Recommendations

Ingest /proc/meminfo and /proc/vmstat metrics into your telemetry pipeline for longitudinal analysis
Alert on kernel PageTables values exceeding a baseline threshold for the host role
Review dmesg output for allocation failures or OOM-killer activity on hosts running affected kernels

How to Mitigate CVE-2026-63953

Immediate Actions Required

Identify Linux hosts running kernels that include the pre-patch migrate_vma_insert_huge_pmd_page() code
Apply the vendor-supplied kernel update containing commits 24861d04f197 and 2c6f81d58741
Prioritize hosts running GPU or accelerator workloads that exercise device page migration

Patch Information

The fix is available upstream in the Linux kernel stable tree. Two reference commits address the leak by introducing a free_abort label that invokes pte_free() on the orphaned pgtable before returning. Refer to the primary fix commit and the stable backport commit. Apply the corresponding distribution kernel update as soon as it is available.

Workarounds

Reboot affected hosts periodically to reclaim leaked page-table memory until patching is complete
Disable transparent huge pages on affected workloads where feasible to reduce hits on the PMD migration path
Restrict use of device drivers that invoke migrate_vma_* APIs on unpatched hosts until updates are applied

bash

# Verify running kernel and check for the fix
uname -r
# Confirm the commits are present in your distribution's kernel changelog
rpm -q --changelog kernel | grep -E '24861d04f197|2c6f81d58741'
# Debian/Ubuntu equivalent
apt changelog linux-image-$(uname -r) | grep -E '24861d04f197|2c6f81d58741'