CVE-2026-89755 Overview
CVE-2026-89755 is a Linux kernel vulnerability in the device memory migration subsystem (mm/migrate_device). The flaw resides in __migrate_device_pages(), which reads the folio mapping before calling folio_free_swap(). When the swap cache free succeeds, the folio is detached from swap space but the previously saved mapping pointer becomes stale. Passing that stale mapping to folio_migrate_mapping() causes the kernel to operate on swap_space.i_pages with invalid reference accounting, eventually triggering a folio reference count BUG. A local, low-privileged user can trigger this condition to compromise kernel integrity and availability.
Critical Impact
A local attacker can trigger kernel-level memory corruption and reference-count corruption, leading to denial of service or potential local privilege escalation on affected Linux systems.
Affected Products
- Linux kernel versions containing the mm/migrate_device device page migration code prior to the upstream fix
- Distributions shipping vulnerable stable kernel branches referenced by commits 34a00895d032 and 8ffedc6573a6
- Systems using device memory migration (for example, GPU/accelerator drivers relying on HMM and device private memory)
Discovery Timeline
- 2026-09-11 - CVE-2026-89755 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89755
Vulnerability Analysis
The bug lives in __migrate_device_pages() within the Linux kernel memory migration path used to move pages between system RAM and device memory. The function caches a pointer to the folio's mapping field early in its execution. It then calls folio_free_swap() which, on success, removes the folio from the swap cache and dissociates it from swap_space.
The cached mapping pointer is not refreshed after this state change. The function subsequently passes the stale pointer to folio_migrate_mapping(), which selects the mapped-folio code path and performs reference-counted operations against swap_space.i_pages. Because the folio no longer belongs to that address space, the accounting drifts and the kernel eventually hits a folio reference count BUG.
A second defect compounds the issue: after a successful large-folio split, the local variable nr still reflects the original large folio's page count. Each split page is now an independent order-0 folio and must be processed with its own swapcache lookup. The fix resets nr to 1 and refreshes the saved mapping after folio_free_swap().
Root Cause
The root cause is a stale pointer use combined with incorrect loop accounting after a folio split. The mapping value read before folio_free_swap() no longer describes the folio's state after the call. This is a state-tracking defect in the kernel memory management subsystem that manifests as reference-count corruption on swap cache address space.
Attack Vector
Exploitation requires local access with low privileges. An attacker capable of triggering device memory migration on a folio that resides in the swap cache can drive the code path into the stale mapping. Workloads that use device private memory through HMM-enabled drivers are the primary trigger surface. The immediate outcome is a kernel BUG and system crash; corrupted reference counts on shared kernel structures also create conditions that skilled attackers may leverage for further memory-safety exploitation.
See the upstream fixes for the exact patched logic: Kernel Git Commit 34a0089 and Kernel Git Commit 8ffedc6.
Detection Methods for CVE-2026-89755
Indicators of Compromise
- Kernel panic or BUG messages referencing folio reference counts, folio_migrate_mapping, or __migrate_device_pages in dmesg and /var/log/kern.log
- Unexpected process termination or system instability on hosts running GPU or accelerator workloads that exercise device memory migration
- Warnings involving swap cache accounting or swap_space.i_pages reference imbalances
Detection Strategies
- Inventory running kernel versions against the upstream stable branches referenced by commits 34a00895d032 and 8ffedc6573a6 to identify unpatched hosts
- Correlate kernel crash telemetry with workloads that trigger HMM device migration to isolate systems exposed to the vulnerable code path
- Monitor for repeated kernel oops or BUG events on the same host, which can indicate attempted exploitation rather than a one-off fault
Monitoring Recommendations
- Forward kernel.* syslog facility events to a centralized log platform and alert on folio, migrate, or swapcache BUG signatures
- Track kdump crash artifacts on servers running GPU compute, machine learning, or virtualization workloads
- Baseline normal kernel oops rates per host and alert on statistically significant deviations
How to Mitigate CVE-2026-89755
Immediate Actions Required
- Apply the vendor kernel update that incorporates upstream commits 34a00895d032 and 8ffedc6573a6 as soon as it is available for your distribution
- Prioritize patching of multi-tenant hosts, shared compute nodes, and systems that expose device memory migration to unprivileged users
- Restrict local shell and container escape opportunities on affected hosts until patches are deployed
Patch Information
The upstream fix refreshes the saved folio mapping after folio_free_swap() and resets nr to 1 following a successful large-folio split so each order-0 folio is processed independently. Consume the fix through your distribution's stable kernel update channel. Reference the upstream patches at Kernel Git Commit 34a0089 and Kernel Git Commit 8ffedc6.
Workarounds
- Where feasible, reduce or eliminate workloads that trigger device memory migration on affected hosts until patched kernels are deployed
- Enforce least privilege for local accounts and constrain container capabilities to limit who can drive the vulnerable code path
- Enable kernel crash collection (kdump) so any exploitation attempts produce forensic evidence for investigation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
