CVE-2026-43404

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43404", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.007Z", "datePublished": "2026-05-08T14:21:44.929Z", "dateUpdated": "2026-05-11T22:23:55.638Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:23:55.638Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: Fix a hmm_range_fault() livelock / starvation problem\n\nIf hmm_range_fault() fails a folio_trylock() in do_swap_page,\ntrying to acquire the lock of a device-private folio for migration,\nto ram, the function will spin until it succeeds grabbing the lock.\n\nHowever, if the process holding the lock is depending on a work\nitem to be completed, which is scheduled on the same CPU as the\nspinning hmm_range_fault(), that work item might be starved and\nwe end up in a livelock / starvation situation which is never\nresolved.\n\nThis can happen, for example if the process holding the\ndevice-private folio lock is stuck in\n migrate_device_unmap()->lru_add_drain_all()\nsinc lru_add_drain_all() requires a short work-item\nto be run on all online cpus to complete.\n\nA prerequisite for this to happen is:\na) Both zone device and system memory folios are considered in\n migrate_device_unmap(), so that there is a reason to call\n lru_add_drain_all() for a system memory folio while a\n folio lock is held on a zone device folio.\nb) The zone device folio has an initial mapcount > 1 which causes\n at least one migration PTE entry insertion to be deferred to\n try_to_migrate(), which can happen after the call to\n lru_add_drain_all().\nc) No or voluntary only preemption.\n\nThis all seems pretty unlikely to happen, but indeed is hit by\nthe \"xe_exec_system_allocator\" igt test.\n\nResolve this by waiting for the folio to be unlocked if the\nfolio_trylock() fails in do_swap_page().\n\nRename migration_entry_wait_on_locked() to\nsoftleaf_entry_wait_unlock() and update its documentation to\nindicate the new use-case.\n\nFuture code improvements might consider moving\nthe lru_add_drain_all() call in migrate_device_unmap() to be\ncalled *after* all pages have migration entries inserted.\nThat would eliminate also b) above.\n\nv2:\n- Instead of a cond_resched() in hmm_range_fault(),\n eliminate the problem by waiting for the folio to be unlocked\n in do_swap_page() (Alistair Popple, Andrew Morton)\nv3:\n- Add a stub migration_entry_wait_on_locked() for the\n !CONFIG_MIGRATION case. (Kernel Test Robot)\nv4:\n- Rename migrate_entry_wait_on_locked() to\n softleaf_entry_wait_on_locked() and update docs (Alistair Popple)\nv5:\n- Add a WARN_ON_ONCE() for the !CONFIG_MIGRATION\n version of softleaf_entry_wait_on_locked().\n- Modify wording around function names in the commit message\n (Andrew Morton)\n\n(cherry picked from commit a69d1ab971a624c6f112cea61536569d579c3215)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/migrate.h", "mm/filemap.c", "mm/memory.c", "mm/migrate.c", "mm/migrate_device.c"], "versions": [{"version": "1afaeb8293c9addbf4f9140bdd22635fed763459", "lessThan": "94b6d0ba4b640ba23bb6c708a59316e74e5ede63", "status": "affected", "versionType": "git"}, {"version": "1afaeb8293c9addbf4f9140bdd22635fed763459", "lessThan": "7e6e2fc91d4b9b12ec6e137019532568ebcf2680", "status": "affected", "versionType": "git"}, {"version": "1afaeb8293c9addbf4f9140bdd22635fed763459", "lessThan": "b570f37a2ce480be26c665345c5514686a8a0274", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/migrate.h", "mm/filemap.c", "mm/memory.c", "mm/migrate.c", "mm/migrate_device.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/94b6d0ba4b640ba23bb6c708a59316e74e5ede63"}, {"url": "https://git.kernel.org/stable/c/7e6e2fc91d4b9b12ec6e137019532568ebcf2680"}, {"url": "https://git.kernel.org/stable/c/b570f37a2ce480be26c665345c5514686a8a0274"}], "title": "mm: Fix a hmm_range_fault() livelock / starvation problem", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/migrate.h", "mm/filemap.c", "mm/memory.c", "mm/migrate.c", "mm/migrate_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "94b6d0ba4b640ba23bb6c708a59316e74e5ede63", "status": "affected", "version": "1afaeb8293c9addbf4f9140bdd22635fed763459", "versionType": "git"}, {"lessThan": "7e6e2fc91d4b9b12ec6e137019532568ebcf2680", "status": "affected", "version": "1afaeb8293c9addbf4f9140bdd22635fed763459", "versionType": "git"}, {"lessThan": "b570f37a2ce480be26c665345c5514686a8a0274", "status": "affected", "version": "1afaeb8293c9addbf4f9140bdd22635fed763459", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/migrate.h", "mm/filemap.c", "mm/memory.c", "mm/migrate.c", "mm/migrate_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6461E17-9936-4679-8F97-568871A6FBE4", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: Fix a hmm_range_fault() livelock / starvation problem\n\nIf hmm_range_fault() fails a folio_trylock() in do_swap_page,\ntrying to acquire the lock of a device-private folio for migration,\nto ram, the function will spin until it succeeds grabbing the lock.\n\nHowever, if the process holding the lock is depending on a work\nitem to be completed, which is scheduled on the same CPU as the\nspinning hmm_range_fault(), that work item might be starved and\nwe end up in a livelock / starvation situation which is never\nresolved.\n\nThis can happen, for example if the process holding the\ndevice-private folio lock is stuck in\n migrate_device_unmap()->lru_add_drain_all()\nsinc lru_add_drain_all() requires a short work-item\nto be run on all online cpus to complete.\n\nA prerequisite for this to happen is:\na) Both zone device and system memory folios are considered in\n migrate_device_unmap(), so that there is a reason to call\n lru_add_drain_all() for a system memory folio while a\n folio lock is held on a zone device folio.\nb) The zone device folio has an initial mapcount > 1 which causes\n at least one migration PTE entry insertion to be deferred to\n try_to_migrate(), which can happen after the call to\n lru_add_drain_all().\nc) No or voluntary only preemption.\n\nThis all seems pretty unlikely to happen, but indeed is hit by\nthe \"xe_exec_system_allocator\" igt test.\n\nResolve this by waiting for the folio to be unlocked if the\nfolio_trylock() fails in do_swap_page().\n\nRename migration_entry_wait_on_locked() to\nsoftleaf_entry_wait_unlock() and update its documentation to\nindicate the new use-case.\n\nFuture code improvements might consider moving\nthe lru_add_drain_all() call in migrate_device_unmap() to be\ncalled *after* all pages have migration entries inserted.\nThat would eliminate also b) above.\n\nv2:\n- Instead of a cond_resched() in hmm_range_fault(),\n eliminate the problem by waiting for the folio to be unlocked\n in do_swap_page() (Alistair Popple, Andrew Morton)\nv3:\n- Add a stub migration_entry_wait_on_locked() for the\n !CONFIG_MIGRATION case. (Kernel Test Robot)\nv4:\n- Rename migrate_entry_wait_on_locked() to\n softleaf_entry_wait_on_locked() and update docs (Alistair Popple)\nv5:\n- Add a WARN_ON_ONCE() for the !CONFIG_MIGRATION\n version of softleaf_entry_wait_on_locked().\n- Modify wording around function names in the commit message\n (Andrew Morton)\n\n(cherry picked from commit a69d1ab971a624c6f112cea61536569d579c3215)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mm: Corrige un problema de interbloqueo / inanici\u00f3n de hmm_range_fault() Si hmm_range_fault() falla un folio_trylock() en do_swap_page, intentando adquirir el bloqueo de un folio privado de dispositivo para migraci\u00f3n, a la RAM, la funci\u00f3n girar\u00e1 hasta que logre adquirir el bloqueo. Sin embargo, si el proceso que mantiene el bloqueo depende de que se complete un elemento de trabajo, el cual est\u00e1 programado en la misma CPU que el hmm_range_fault() en espera activa, ese elemento de trabajo podr\u00eda sufrir inanici\u00f3n y terminamos en una situaci\u00f3n de interbloqueo / inanici\u00f3n que nunca se resuelve. Esto puede ocurrir, por ejemplo, si el proceso que mantiene el bloqueo del folio privado del dispositivo est\u00e1 atascado en migrate_device_unmap() -> lru_add_drain_all()\nya que lru_add_drain_all() requiere que se ejecute un elemento de trabajo corto en todas las CPUs en l\u00ednea para completarse. Un requisito previo para que esto ocurra es:\na) Tanto los folios de dispositivo de zona como los de memoria del sistema se consideran en migrate_device_unmap(), de modo que hay una raz\u00f3n para llamar a lru_add_drain_all() para un folio de memoria del sistema mientras se mantiene un bloqueo de folio en un folio de dispositivo de zona.\nb) El folio de dispositivo de zona tiene un mapcount inicial mayor que 1 lo que provoca que al menos una inserci\u00f3n de entrada PTE de migraci\u00f3n se posponga a try_to_migrate(), lo cual puede ocurrir despu\u00e9s de la llamada a lru_add_drain_all().\nc) Sin o solo con expropiaci\u00f3n voluntaria. Todo esto parece bastante improbable que ocurra, pero de hecho es afectado por la prueba igt \u2019xe_exec_system_allocator\u2019. Resuelve esto esperando a que el folio se desbloquee si el folio_trylock() falla en do_swap_page(). Renombra migration_entry_wait_on_locked() a softleaf_entry_wait_unlock() y actualiza su documentaci\u00f3n para indicar el nuevo caso de uso. Futuras mejoras de c\u00f3digo podr\u00edan considerar mover la llamada a lru_add_drain_all() en migrate_device_unmap() para que se llame despu\u00e9s de que todas las p\u00e1ginas tengan entradas de migraci\u00f3n insertadas.\nEso eliminar\u00eda tambi\u00e9n b) lo anterior. v2:\n- En lugar de un cond_resched() en hmm_range_fault(), elimina el problema esperando a que el folio se desbloquee en do_swap_page() (Alistair Popple, Andrew Morton)\nv3:\n- A\u00f1ade un stub migration_entry_wait_on_locked() para el caso !CONFIG_MIGRATION. (Kernel Test Robot)\nv4:\n- Renombra migrate_entry_wait_on_locked() a softleaf_entry_wait_on_locked() y actualiza la documentaci\u00f3n (Alistair Popple)\nv5:\n- A\u00f1ade un WARN_ON_ONCE() para la versi\u00f3n !CONFIG_MIGRATION de softleaf_entry_wait_on_locked().\n- Modifica la redacci\u00f3n en torno a los nombres de las funciones en el mensaje de commit (Andrew Morton) (seleccionado de commit a69d1ab971a624c6f112cea61536569d579c3215)"}], "id": "CVE-2026-43404", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T15:16:51.887", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e6e2fc91d4b9b12ec6e137019532568ebcf2680"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94b6d0ba4b640ba23bb6c708a59316e74e5ede63"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b570f37a2ce480be26c665345c5514686a8a0274"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm: Fix a hmm_range_fault() livelock / starvation problem", "id": "2468156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468156"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the memory management subsystem, specifically within the `hmm_range_fault()` function. When attempting to migrate a device-private memory page to system RAM, a failure to acquire a lock could lead to a continuous loop, preventing the system from progressing. This can result in a livelock, effectively causing a Denial of Service (DoS) where the system becomes unresponsive."], "name": "CVE-2026-43404", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43404\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43404\nhttps://lore.kernel.org/linux-cve-announce/2026050841-CVE-2026-43404-4ddb@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1afaeb8293c9addbf4f9140bdd22635fed763459,94b6d0ba4b640ba23bb6c708a59316e74e5ede63)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1afaeb8293c9addbf4f9140bdd22635fed763459,7e6e2fc91d4b9b12ec6e137019532568ebcf2680)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1afaeb8293c9addbf4f9140bdd22635fed763459,b570f37a2ce480be26c665345c5514686a8a0274)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T18:15:13.439758+00:00", "updated": "2026-05-21T23:15:17.149320+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}