EUVD-2026-66497
GHSA-8m43-m8xf-jm3h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DRM device group access suffices; C:H and I:H reflect plausible out-of-bounds PMD memory exposure before VM_BUG_ON_VMA crash fires.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/shmem_helper: Check VMA boundaries for PMD mappings
In the ->huge_fault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA.
All other ->huge_fault handlers have similar checks and the resulting mapping will trigger a VM_BUG_ON_VMA() if it ever reaches copy_pmd_range().
AnalysisAI
PMD huge page mapping boundary violation in the Linux kernel's drm/shmem_helper subsystem allows local users with low privileges to trigger out-of-bounds memory mappings via the DRM ->huge_fault handler. The handler installs PMD-level Transparent Huge Page mappings without verifying they remain within Virtual Memory Area boundaries, triggering a VM_BUG_ON_VMA() assertion when the mapping subsequently reaches copy_pmd_range() during fork or remap operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running an affected Linux kernel version with DRM support compiled in and a shmem-backed GPU driver active (such as virtio-gpu, lima, or panfrost - drivers using drm_gem_shmem_object). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation with claimed full impact across all three pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with membership in the 'video' or 'render' group on an affected kernel opens a DRM shmem-backed buffer object and maps it in a way that triggers the ->huge_fault handler with a huge page that extends past the VMA's end boundary. When the process subsequently calls fork(), copy_pmd_range() encounters the malformed PMD mapping and the kernel fires VM_BUG_ON_VMA(), crashing the system; in a more targeted scenario, the window between PMD installation and the crash could be exploited to read or write memory outside the intended VMA region. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.1.10 or Linux kernel 7.2, which incorporate the boundary check patch for drm/shmem_helper. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems and identify affected kernel versions (prior to 7.1.10 or 7.2). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today