CVE-2026-68163

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/page_vma_mapped: fix device-private PMD handling

Commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support

device-private entries") introduced the concept of device-private PMD

entries, but did not correctly update the rmap walk code to account for

them.

As a result, when page_vma_mapped_walk() encounters device-private PMD

entries, it takes no action other than to acquire the PMD lock and exit.

However this is highly problematic for two reasons - firstly, device

private entries possess a PFN so check_pmd() needs to be called to ensure

an overlapping PFN range.

Secondly, and more importantly, if PVMW_MIGRATION is set the caller

assumes the returned entry is a migration entry, resulting in memory

corruption when the caller tries to interpret the device private entry as

such.

In addition, commit 146287290023 ("mm/huge_memory: implement

device-private THP splitting") allowed device private PMDs to be split

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References