CVE-2026-80686 Overview
CVE-2026-80686 is a Linux kernel vulnerability in the memory migration subsystem. The flaw resides in migrate_vma_collect_pmd() within the mm/migrate_device.c code path. The functions pte_pfn() and pte_dirty() are invoked on non-present page table entries (PTEs), including device-private entries. These helpers have undefined behavior when called on non-present PTEs. The condition can trigger kernel crashes via pte_pfn() or corrupt dirty folio accounting via pte_dirty(). Upstream maintainers resolved the issue by guarding both calls with pte_present() checks.
Critical Impact
Local workloads that exercise device memory migration paths can trigger kernel instability or inconsistent memory dirty-tracking state.
Affected Products
- Linux kernel (mainline) memory migration subsystem
- Kernel builds including mm/migrate_device.c prior to the referenced stable commits
- Systems using device-private memory (for example, GPU heterogeneous memory management workloads)
Discovery Timeline
- 2026-08-28 - CVE-2026-80686 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80686
Vulnerability Analysis
The defect is a Kernel Vulnerability affecting device memory migration logic. migrate_vma_collect_pmd() walks page table entries to collect source pages for migration. During this walk, the function calls pte_pfn() and pte_dirty() on PTE values that may not represent a present mapping. Non-present entries include swap entries and device-private entries used by drivers that back memory with accelerator or GPU storage.
Because pte_pfn() and pte_dirty() are only defined for present PTEs, invoking them on non-present entries yields architecture-dependent results. The result can be an invalid page frame number that dereferences into unmapped kernel memory. It can also produce spurious dirty flags that cause folio accounting to mark clean pages as dirty. The fix wraps each call site with a pte_present() predicate so the helpers execute only on valid, present PTEs.
Root Cause
The root cause is improper input validation on PTE state before invoking helpers that require present entries. The migration collector assumed present-PTE semantics without checking, violating the kernel's PTE helper contract.
Attack Vector
Exploitation requires the ability to execute workloads that traverse device-private memory migration paths. This typically means local processes using drivers that create device-private mappings. Remote exploitation is not indicated by the upstream fix description. The primary observed impacts are denial of service through kernel crashes and accounting corruption in dirty folio tracking.
No verified public proof-of-concept exploit code is available. See the upstream commits for the exact patch diff: Linux Kernel Commit 26f9ca8 and Linux Kernel Commit 86d5544.
Detection Methods for CVE-2026-80686
Indicators of Compromise
- Unexpected kernel oops or panic traces referencing migrate_vma_collect_pmd in the call stack.
- Kernel log entries showing invalid PFN dereferences originating from the mm/migrate_device.c path.
- Inconsistent dirty page accounting on workloads that use device-private memory or GPU HMM drivers.
Detection Strategies
- Correlate dmesg and journalctl -k output for kernel oops signatures that reference the migration collector on hosts running unpatched kernels.
- Inventory kernel build versions across Linux fleets and flag hosts running kernels that predate the referenced stable commits.
- Monitor host telemetry for kernel crash-loop restarts on systems that host GPU or accelerator workloads.
Monitoring Recommendations
- Forward kernel ring buffer and kdump artifacts to a centralized log platform for retention and search.
- Baseline crash frequency for GPU and HMM workloads so anomalies stand out during triage.
- Track kernel package versions through configuration management and alert on drift from patched baselines.
How to Mitigate CVE-2026-80686
Immediate Actions Required
- Identify Linux hosts running kernels that lack the upstream fix commits listed in the references.
- Prioritize patching on systems that use device-private memory, GPU compute drivers, or heterogeneous memory management workloads.
- Enable kdump or equivalent crash-collection tooling so any residual crashes produce actionable forensic data.
Patch Information
Apply the upstream stable-tree fixes that guard pte_pfn() and pte_dirty() with pte_present() in migrate_vma_collect_pmd(). Relevant references include Linux Kernel Commit 26f9ca8, Linux Kernel Commit 2be94d6, Linux Kernel Commit 42f30fa, Linux Kernel Commit 5b94870, Linux Kernel Commit 63867c8, and Linux Kernel Commit 86d5544. Consume patched kernels through your Linux distribution's stable update channel.
Workarounds
- Restrict use of drivers that create device-private memory mappings on hosts that cannot be patched immediately.
- Limit local user access on affected systems until patched kernels are deployed to reduce exposure to workloads that trigger the migration path.
- Reboot into a patched kernel image after installation to ensure the fix is active in the running kernel.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.