EUVD-2026-76667
GHSA-f448-r8g9-p8j7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because triggering requires concurrent HMM device migration and swapcache occupancy; local PR:L user; C/I/H retained for worst-case kernel memory corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mm/migrate_device: clear stale mapping after freeing swapcache
__migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space.
Passing the stale mapping to folio_migrate_mapping() makes it use the mapped-folio path for a folio that is no longer in swapcache. It can then operate on swap_space.i_pages with invalid reference accounting, eventually triggering a folio reference count BUG.
After a successful split, nr still contains the number of pages in the original large folio, although each resulting page is now a separate order-0 folio. Reset nr to 1 so each split folio is processed separately, including its own swapcache removal and mapping lookup.
Refresh the saved mapping after folio_free_swap() so the current folio state is used during migration.
AnalysisAI
Stale swap-cache mapping in __migrate_device_pages() triggers invalid folio reference-count accounting in the Linux kernel mm/migrate_device subsystem, ultimately producing a BUG_ON kernel panic and potential memory corruption. The defect has two related components: the folio->mapping pointer is captured before folio_free_swap() executes, leaving a dangling reference to swap_space after swap-cache removal, and after a large folio is split the migration loop counter nr is not reset to 1, causing split order-0 folios to be processed with the original large-folio count. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local system access with at least low-privilege credentials (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates practical exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or later, or apply the 7.3-rc1 stable patches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running kernel versions prior to 7.2.4 or 7.3-rc1 that use HMM, GPU pass-through, or device-migration features, prioritizing production AI/ML compute nodes and specialized hardware deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today