CVE-2026-90391
Description
In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone dmirror_fault() is called from the dmirror_read() and dmirror_write() retry loops after dmirror_do_read() or dmirror_do_write() finds a missing device page table entry. If the mirrored mm has already exited, mmget_not_zero() fails. The current code returns 0 in that case, which tells the caller that faulting succeeded even though no page was faulted and no device page table entry was installed. The caller then retries the same address, hits -ENOENT again, and can loop forever without making progress. Return -EFAULT instead, so the ioctl fails when the mirrored mm is no longer faultable.
How to fix
- Linux Linux50606ced303782f8715e2d0b98ca374ea498fa29, 541a67f21ab807c8dbc0ea88d5a2eb73b2618090, d8e64ffab01e032ae29159d27230ace8cf8bdc80, 2636569ea7c19d9a40db4a1e8d0a027bdacf1569, 701347e31aa607f3782403151a3125729d685275, af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655, a2074f86fc9653831e4fb7b711bb715db330f182, 6a8024511ddf4877435c34fb3d6028aa8e590649 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < 50606ced303782f8715e2d0b98ca374ea498fa29, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < 541a67f21ab807c8dbc0ea88d5a2eb73b2618090, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < d8e64ffab01e032ae29159d27230ace8cf8bdc80, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < 2636569ea7c19d9a40db4a1e8d0a027bdacf1569, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < 701347e31aa607f3782403151a3125729d685275, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < a2074f86fc9653831e4fb7b711bb715db330f182, b2ef9f5a5cb37643ca5def3516c546457074b882 ≤ v < 6a8024511ddf4877435c34fb3d6028aa8e590649, 5.8 | 50606ced303782f8715e2d0b98ca374ea498fa29, 541a67f21ab807c8dbc0ea88d5a2eb73b2618090, d8e64ffab01e032ae29159d27230ace8cf8bdc80, 2636569ea7c19d9a40db4a1e8d0a027bdacf1569, 701347e31aa607f3782403151a3125729d685275, af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655, a2074f86fc9653831e4fb7b711bb715db330f182, 6a8024511ddf4877435c34fb3d6028aa8e590649 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.