CVE-2026-93284

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93284", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.099Z", "datePublished": "2026-09-24T16:02:08.527Z", "dateUpdated": "2026-10-19T09:08:38.485Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:08:38.485Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: dma-unmap pages before handling migration errors\n\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\n\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Local ioctl/fault path only: DRM_IOCTL_XE_VM_CREATE (FAULT_MODE) and DRM_IOCTL_XE_VM_BIND (CPU_ADDR_MIRROR) on /dev/dri/renderD* migrate the caller's anonymous range to VRAM, then do_swap_page() invokes drm_pagemap_migrate_to_ram() -> __drm_pagemap_migrate_to_ram(), or xe_bo_move() calls xe_svm_bo_evict() -> drm_pagemap_evict_to_ram(). No remote protocol byte reaches those functions.\nAC:L - The attacker creates the SVM range, migrates it to VRAM, and CPU-faults or TTM-evicts it. After drm_pagemap_migrate_map_system_pages() has dma_map_page()'d dest folios, they force err_finalize by exhausting gt->usm.bb_pool so xe_svm_copy_to_ram()/xe_bb_new() returns -ENOMEM, or by fragmenting IOVA so dma_iova_try_alloc() fails and a later dma_map_page() returns -EFAULT. No victim timing.\nPR:L - DRM_IOCTL_XE_VM_CREATE and DRM_IOCTL_XE_VM_BIND are DRM_RENDER_ALLOW; xe_vm_create_ioctl() performs no capable() or DRM-master check. An unprivileged local user with typical render/video-group access to /dev/dri/renderD* on an Intel Xe discrete GPU (CONFIG_DRM_XE_PAGEMAP defaults to y) can create a fault-mode VM and reach the patched functions.\nUI:N - The attacking process opens the render node, creates its own fault-mode VM, CPU_ADDR_MIRROR-binds its anonymous mapping, prefetches or GPU-faults it into VRAM, then CPU-accesses or forces TTM eviction. No other user must mount a filesystem or open a file.\nS:C - On err_finalize, drm_pagemap_migration_unlock_put_pages() folio_put()s the destination RAM folios and zeros migrate_pfn, so drm_pagemap_migrate_unmap_pages() sees a NULL page and skips dma_unmap_page(). Those IOMMU PTEs remain aimed at pages already returned to the buddy allocator, which is an IOMMU/DMA isolation bypass.\nC:H - Destination folios from drm_pagemap_migrate_populate_ram_pfn() are put while still dma_map_page()'d. Recycled host pages stay IOMMU-reachable through the leaked translation, so later DMA can disclose their new kernel or cross-process contents rather than a bounded pointer leak.\nI:H - The leaked mappings are DMA_FROM_DEVICE (Xe copy-from-VRAM via xe_svm_copy_to_ram()). After folio_put(), a GPU/IOMMU transaction through those IOVAs writes into whatever reused the physical pages, an arbitrary physical write through the IOMMU rather than a bounded corruption.\nA:H - Each failed __drm_pagemap_migrate_to_ram()/drm_pagemap_evict_to_ram() leaks that range's dma_map_page() IOVAs; the attacker loops CPU faults after inducing xe_bb_new() or map errors. Unbounded IOVA growth wedges later maps, and DMA into buddy-reused pages oopses or panics, not a mere slowdown."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_pagemap.c"], "versions": [{"version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d", "lessThan": "e4331c6644db85bc6ceb470bd84bcf371b6dbfa6", "status": "affected", "versionType": "git"}, {"version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d", "lessThan": "415f5a755cec5164b149037bf294e270b78d36c6", "status": "affected", "versionType": "git"}, {"version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d", "lessThan": "9e6372ec2a3990662ae0a67f56ac0aee19848d5b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_pagemap.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6"}, {"url": "https://git.kernel.org/stable/c/415f5a755cec5164b149037bf294e270b78d36c6"}, {"url": "https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b"}], "title": "drm/pagemap: dma-unmap pages before handling migration errors", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_pagemap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e4331c6644db85bc6ceb470bd84bcf371b6dbfa6", "status": "affected", "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d", "versionType": "git"}, {"lessThan": "415f5a755cec5164b149037bf294e270b78d36c6", "status": "affected", "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d", "versionType": "git"}, {"lessThan": "9e6372ec2a3990662ae0a67f56ac0aee19848d5b", "status": "affected", "version": "f86ad0ed620cb3c91ec7d5468e93ac68d727539d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_pagemap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: dma-unmap pages before handling migration errors\n\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\n\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping."}], "id": "CVE-2026-93284", "lastModified": "2026-10-19T10:17:20.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T17:17:09.587", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/415f5a755cec5164b149037bf294e270b78d36c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/pagemap: dma-unmap pages before handling migration errors", "id": "2540525", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540525"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/pagemap: dma-unmap pages before handling migration errors\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping.", "A flaw was found in the Linux kernel's DRM (Direct Rendering Manager) pagemap subsystem. During page migration error handling, the kernel clears the page tracking array before finishing Direct Memory Access (DMA) unmapping operations. A local user could exploit this flaw by triggering migration failures, causing improper memory unmapping and leading to a system crash and Denial of Service (DoS)."], "name": "CVE-2026-93284", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93284\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93284\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93284.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f86ad0ed620cb3c91ec7d5468e93ac68d727539d,e4331c6644db85bc6ceb470bd84bcf371b6dbfa6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f86ad0ed620cb3c91ec7d5468e93ac68d727539d,9e6372ec2a3990662ae0a67f56ac0aee19848d5b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:15:15.418615+00:00", "updated": "2026-10-01T22:30:14.171220+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}