CVE-2026-46277

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46277", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.109Z", "datePublished": "2026-06-08T15:41:19.760Z", "dateUpdated": "2026-08-05T12:30:59.977Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:30:59.977Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/zone_device: do not touch device folio after calling ->folio_free()\n\nThe contents of a device folio can immediately change after calling\n->folio_free(), as the folio may be reallocated by a driver with a\ndifferent order. Instead of touching the folio again to extract the\npgmap, use the local stack variable when calling percpu_ref_put_many()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only when a ZONE_DEVICE folio is freed via `__folio_put()` \u2192 `free_zone_device_folio()`, which occurs during device-private memory migration teardown (e.g. `migrate_vma_finalize()` \u2192 `folio_put()` on source folios). That path is driven by local process activity\u2014mmap, CPU page faults on GPU-resident memory, and concurrent GPU allocation\u2014not by remote network packet handling.\nAC:L - Exploitation requires winning a race between `->folio_free()` returning a folio to a driver free list and `percpu_ref_put_many()` re-reading `folio->pgmap`, but an attacker can control both sides by running concurrent GPU migration and allocation threads on the same device. No conditions outside attacker influence (specific memory layout, victim state) are required beyond normal GPU workload timing.\nPR:L - Triggering device-private folio migration and free requires only an unprivileged local user with access to a GPU render node (e.g. `/dev/dri/renderD*`, typically granted via the `render` group), not real root in the init namespace. No CAP_SYS_ADMIN or other elevated capability is needed to exercise the migrate/fault/alloc paths that reach `free_zone_device_folio()`.\nUI:N - Exploitation is fully automatable through GPU compute or graphics workloads that migrate memory between system RAM and device-private VRAM; no victim click, mount, or other deliberate interactive action beyond the attacker running their own program is required.\nS:U - Successful exploitation corrupts kernel memory and `dev_pagemap` refcounts to achieve kernel privilege escalation within the host kernel security boundary. It does not inherently cross a VM/host or IOMMU/DMA isolation boundary, even though GPU cloud tenants are a plausible deployment scenario.\nC:H - After `->folio_free()`, the folio may be immediately reallocated and its metadata overwritten; reading `folio->pgmap` afterward is a use-after-free that can dereference attacker-influenced or stale pointers. Wrong `percpu_ref` targets can also cause premature `pgmap` teardown, enabling further kernel memory disclosure.\nI:H - Calling `percpu_ref_put_many()` on a corrupted or wrong `pgmap->ref` (potentially with a large `nr` from a huge folio) corrupts kernel refcount state and adjacent memory, which is a standard path to arbitrary kernel write and control-flow hijack, not merely a bounded data change.\nA:H - Incorrect `percpu_ref_put_many()` on a stale or wrong `pgmap` can underflow refcounts, trigger use-after-free of `dev_pagemap`, or cause immediate kernel BUG/WARN/oops during memory teardown. Even without full exploit development, the bug reliably threatens kernel crashes and denial of service during device folio free."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/memremap.c"], "versions": [{"version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9", "lessThan": "85be0a262e39c706edb53c88af8afde2e98222ba", "status": "affected", "versionType": "git"}, {"version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9", "lessThan": "39928984956037cabd304321cb8f342e47421db5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/memremap.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba"}, {"url": "https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5"}], "title": "mm/zone_device: do not touch device folio after calling ->folio_free()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/memremap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "85be0a262e39c706edb53c88af8afde2e98222ba", "status": "affected", "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9", "versionType": "git"}, {"lessThan": "39928984956037cabd304321cb8f342e47421db5", "status": "affected", "version": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/memremap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/zone_device: do not touch device folio after calling ->folio_free()\n\nThe contents of a device folio can immediately change after calling\n->folio_free(), as the folio may be reallocated by a driver with a\ndifferent order. Instead of touching the folio again to extract the\npgmap, use the local stack variable when calling percpu_ref_put_many()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/zone_device: no tocar el folio del dispositivo despu\u00e9s de llamar a ->folio_free()\n\nEl contenido de un folio de dispositivo puede cambiar inmediatamente despu\u00e9s de llamar a ->folio_free(), ya que el folio puede ser reasignado por un controlador con un orden diferente. En lugar de tocar el folio de nuevo para extraer el pgmap, usar la variable de pila local al llamar a percpu_ref_put_many()."}], "id": "CVE-2026-46277", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-08T17:16:45.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/zone_device: do not touch device folio after calling ->folio_free()", "id": "2486444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486444"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's memory management, specifically within the `mm/zone_device` component. This vulnerability arises when a device folio is accessed after it has been freed and potentially reallocated by a driver. This can lead to memory corruption, which a local attacker could potentially leverage to cause a denial of service (DoS) or achieve other impacts."], "name": "CVE-2026-46277", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46277\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46277\nhttps://lore.kernel.org/linux-cve-announce/2026060841-CVE-2026-46277-f398@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d245f9b4ab806733a77e51a218ca7b8bc3135cd9,85be0a262e39c706edb53c88af8afde2e98222ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d245f9b4ab806733a77e51a218ca7b8bc3135cd9,39928984956037cabd304321cb8f342e47421db5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.4,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-08T18:45:26.401625+00:00", "updated": "2026-08-12T04:30:04.393005+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}