Linux Kernel EUVD-2026-86163

Requires a running kernel version 6.17 or newer that includes the drm/pagemap device-memory migration code, a GPU driver that exercises drm_pagemap migration (SVM / device memory), and local access to trigger GPU memory migration. The bug only manifests on the migration ERROR path - the flawed cleanup order (calling drm_pagemap_migrate_unmap_pages() after drm_pagemap_migration_unlock_put_pages() has already zeroed the pages array) is reached only when a migration failure occurs, so normal successful migrations are unaffected. Limiting factors: local-only access, the error path is not directly attacker-controlled, and the affected subsystem is only present in very recent kernels with specific GPU drivers enabled.

The input assigns CVSS:3.1 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which substantially overstates real-world risk for what the patch actually describes. This is a cleanup-ordering defect on a migration ERROR path: drm_pagemap_migrate_unmap_pages() reads the pages array to decide which pages need DMA unmapping, but drm_pagemap_migration_unlock_put_pages() clears that array first, so DMA unmapping is skipped/mishandled. The bug only manifests when a device-memory migration error occurs - a condition not directly attacker-triggerable - so AC:L is optimistic (AC:H is more defensible) and the S:C/C:H/I:H rating is not supported by the description, which points to an improper-DMA-unmap/resource-leak outcome rather than reliable confidentiality/integrity compromise. There is no EPSS score, no CISA KEV listing, and no public exploit; SSVC would score exploitation=none and automatable=no. Net: no public exploit identified at time of analysis, and despite the high nominal CVSS this is a low-priority hardening/correctness fix for the niche drm/pagemap GPU-migration subsystem, not an urgent patch. The listed CWE is N/A and the 'Information Disclosure' tag is inconsistent with the actual defect (error-path DMA-unmap ordering).

A local user runs GPU workloads that trigger device-memory (SVM) page migration on a very recent kernel (6.17+) using a driver built on drm/pagemap; if a migration error is induced, pages may be left improperly DMA-unmapped, risking a DMA/resource leak or memory-state corruption that could crash the system. No public exploit exists and the trigger depends on hitting the migration error path rather than attacker-supplied input, making reliable exploitation impractical.