CVE-2026-64131

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/memory: fix spurious warning when unmapping device-private/exclusive pages

Device private and exclusive entries are only supported for anonymous

folios. This condition is tested in __migrate_device_pages() and

make_device_exclusive() using folio_test_anon(). However the unmap path

tests this assumption using vma_is_anonymous().

This is wrong because whilst anonymous VMAs can only contain folios where

folio_test_anon() is true the opposite relation does not hold. A folio

for which folio_test_anon() is true does not imply vma_is_anonymous() is

true. Such a condition can occur if for example a folio is part of a

private filebacked mapping.

In this case vma_is_anonymous() is false as the mapping is filebacked, but

folio_test_anon() may be true, thus permitting devices to migrate the

folio to device private memory. This can lead to the following spurious

warnings during process teardown:

[ 772.737706] --------

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References