CVE-2026-43404

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: Fix a hmm_range_fault() livelock / starvation problem

If hmm_range_fault() fails a folio_trylock() in do_swap_page,

trying to acquire the lock of a device-private folio for migration,

to ram, the function will spin until it succeeds grabbing the lock.

However, if the process holding the lock is depending on a work

item to be completed, which is scheduled on the same CPU as the

spinning hmm_range_fault(), that work item might be starved and

we end up in a livelock / starvation situation which is never

resolved.

This can happen, for example if the process holding the

device-private folio lock is stuck in

migrate_device_unmap()->lru_add_drain_all()

sinc lru_add_drain_all() requires a short work-item

to be run on all online cpus to complete.

A prerequisite for this to happen is:

a) Both zone device and system memory folios are considered in

migrate_device_unmap(), so that there is a reason to call

lru_add

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References