CVE-2026-89967: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89967 Overview

CVE-2026-89967 is an out-of-bounds write vulnerability in the Linux kernel memory migration subsystem. The flaw resides in the mm/migrate_device code path, specifically in the migrate_device_range() and migrate_device_pfns() functions. These routines clear entries following a compound folio to preserve the page-granular representation of PFN arrays. When a compound folio extends beyond the caller-provided range, the clearing loops write past the bounds of the npages-sized array.

The issue was observed with a KASAN-instrumented x86 QEMU kernel using the HMM migrate_anon_huge_zero selftest, triggered through the dmirror_fops_release() path.

Critical Impact
A local, low-privileged user interacting with a device driver that invokes the affected migration helpers can trigger kernel memory corruption, enabling denial of service or local privilege escalation.

Affected Products

Linux kernel versions containing the mm/migrate_device compound folio handling logic
Systems using Heterogeneous Memory Management (HMM) device migration paths
Kernel drivers invoking migrate_device_range() or migrate_device_pfns() (for example, the dmirror HMM test driver and device-memory drivers following the same pattern)

Discovery Timeline

2026-09-16 - CVE-2026-89967 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89967

Vulnerability Analysis

The vulnerability sits inside the device memory migration helpers in mm/migrate_device.c. Both migrate_device_range() and migrate_device_pfns() walk a caller-supplied PFN array of size npages. When the walker encounters a compound folio, it clears the subsequent array entries to keep the array representation page-granular.

The clearing loops do not bound the write count against the number of remaining slots in the npages-sized array. If a compound folio starts near the end of the range and its page count exceeds the remaining slots, the loop writes past the end of the array. This produces an out-of-bounds write into adjacent kernel memory.

An attacker with local access to a device that exercises these paths can corrupt kernel data structures. Depending on adjacent allocations, the corruption can escalate to arbitrary kernel-mode execution, kernel information disclosure, or a system crash.

Root Cause

The root cause is missing boundary validation between a compound folio's page-granular size and the remaining capacity of the npages PFN array. The code assumes any encountered compound folio fits entirely within the range, an invariant not enforced by callers such as dmirror_device_evict_chunk(). This classifies as an Out-of-Bounds Write, closely related to [CWE-787].

Attack Vector

Exploitation requires local access and the ability to interact with a driver that reaches migrate_device_range() or migrate_device_pfns() with a range whose end bisects a compound folio. In the reproducer, closing /dev/hmm_dmirror0 after migrating an anonymous huge page to device memory reaches the vulnerable loop through dmirror_fops_release() and dmirror_device_evict_chunk(). Any driver following the same pattern with attacker-influenced range boundaries is a candidate trigger.

No public exploit or proof-of-concept has been published, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed exploitation code is not reproduced here; see the upstream fixes referenced below for technical specifics.

Detection Methods for CVE-2026-89967

Indicators of Compromise

KASAN slab-out-of-bounds or global-out-of-bounds reports naming migrate_device_range or migrate_device_pfns in the call stack
Unexpected kernel oops or panic in the dmirror_device_evict_chunk → migrate_device_range path
Memory corruption reports adjacent to buffers passed to device migration helpers from HMM-style drivers

Detection Strategies

Deploy debug kernels with KASAN enabled in test fleets to surface out-of-bounds writes originating in mm/migrate_device.c
Audit third-party and out-of-tree drivers that call migrate_device_range() or migrate_device_pfns() for callers that may pass ranges intersecting compound folios
Correlate kernel crash telemetry across endpoints to identify recurring stack signatures matching the affected functions

Monitoring Recommendations

Forward dmesg, kdump, and pstore output to a centralized logging or SIEM platform and alert on kernel BUG, KASAN, or panic events referencing migration functions
Track kernel version inventory across Linux hosts and flag systems still running unpatched builds after the upstream fixes land in your distribution
Monitor process access to HMM device nodes such as /dev/hmm_dmirror* and other device memory interfaces on production hosts where they should not be present

How to Mitigate CVE-2026-89967

Immediate Actions Required

Apply the upstream kernel fixes referenced below and rebuild or update to a distribution kernel that includes both commits
Restrict access to device nodes that reach migrate_device_range() and migrate_device_pfns(), ensuring only trusted service accounts can open them
Prioritize patching on hosts running GPU, accelerator, or HMM-enabled workloads where device memory migration is exercised regularly

Patch Information

The fix stops processing a compound folio when its page-granular representation does not fit in the remaining PFN array, releases any reference and lock taken for the folio, clears the remaining entries, and halts collection. The upstream commits are Kernel Git Commit 99186b185 and Kernel Git Commit dc41e961a. Consume these through your distribution's stable kernel updates rather than backporting manually where possible.

Workarounds

Remove or blacklist the hmm_dmirror test module on production systems where it is not required
Tighten permissions on HMM and device-memory character devices so non-root users cannot open them
Disable or restrict features that invoke device memory migration on workloads that do not require GPU or accelerator memory offload until patched kernels are deployed