Linux Kernel EUVD-2026-86243

Requires a LoongArch CPU whose probed physical address bits (cpu_pabits from CPUCFG1) are fewer than MAX_PHYSMEM_BITS - e.g. the Loongson-2K series - running a kernel built with CONFIG_SPARSEMEM_VMEMMAP where LoongArch did not define DIRECT_MAP_PHYSMEM_END (so the mm.h fallback applies). It is then triggered locally by an operation that invokes get_free_mem_region()/ZONE_DEVICE region allocation, such as device-memory hotplug or GPU/amdkfd bringup. Current Loongson-3C6000 configs are kept in bounds by commit 2969b42c8f99, so those are not affected; the bug is not remotely reachable and requires the specific hardware + config + code path intersection, sharply limiting realistic exposure.

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is the standard auto-generated 'kernel local memory corruption' rating and should be treated skeptically for this specific bug. There is no EPSS score, no CISA KEV listing, and no public exploit code (no public exploit identified at time of analysis) - all three signals point to a NON-priority, latent robustness defect rather than an exploited weapon. Crucially, the flaw is NOT attacker-driven: it manifests when get_free_mem_region()/mhp_get_pluggable_range() pick a ZONE_DEVICE region outside the vmemmap window on LoongArch CPUs whose cpu_pabits is smaller than MAX_PHYSMEM_BITS, and vmemmap_populate() then wraps the memmap into low memory and silently corrupts page tables. The referenced real-world manifestation was a crash triggered by the amdkfd driver during ZONE_DEVICE init on a Loongson-3C6000, i.e. accidental corruption during normal device-memory setup, not a chosen-input exploit. The AC:L in the input is questionable: exploitation is bounded to a narrow hardware/config intersection (LoongArch, specific cpu_pabits, SPARSEMEM_VMEMMAP, device-memory hotplug path), so real-world attack complexity is high. Net: high CVSS number but low real-world risk given the niche architecture, absence of exploitation signals, and non-adversarial trigger path.

On an affected LoongArch system (e.g. Loongson-2K with fewer physical address bits than MAX_PHYSMEM_BITS), a local privileged action that triggers ZONE_DEVICE region allocation - such as device-memory hotplug or an amdkfd/GPU driver bringup - causes get_free_mem_region() to return a region outside the vmemmap window. vmemmap_populate() then wraps the memmap range into low memory and silently corrupts kernel page tables, leading to crashes or memory corruption. No public exploit code exists, and the observed trigger was an ordinary driver init rather than a crafted attack.