CVE-2026-90391

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone dmirror_fault() is called from the dmirror_read() and dmirror_write() retry loops after dmirror_do_read() or dmirror_do_write() finds a missing device page table entry. If the mirrored mm has already exited, mmget_not_zero() fails. The current code returns 0 in that case, which tells the caller that faulting succeeded even though no page was faulted and no device page table entry was installed. The caller then retries the same address, hits -ENOENT again, and can loop forever without making progress. Return -EFAULT instead, so the ioctl fails when the mirrored mm is no longer faultable.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:38.653000

Last modified

2026-10-19 09:19:33.150000

View original CVE JSON

{
  "id": "CVE-2026-90391",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:38.653",
  "lastModified": "2026-10-19T09:19:33.150",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm: fail dmirror_fault() when the mirrored mm is gone\n\ndmirror_fault() is called from the dmirror_read() and dmirror_write()\nretry loops after dmirror_do_read() or dmirror_do_write() finds a missing\ndevice page table entry.\n\nIf the mirrored mm has already exited, mmget_not_zero() fails.  The\ncurrent code returns 0 in that case, which tells the caller that faulting\nsucceeded even though no page was faulted and no device page table entry\nwas installed.  The caller then retries the same address, hits -ENOENT\nagain, and can loop forever without making progress.\n\nReturn -EFAULT instead, so the ioctl fails when the mirrored mm is no\nlonger faultable."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "lib/test_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "50606ced303782f8715e2d0b98ca374ea498fa29",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "541a67f21ab807c8dbc0ea88d5a2eb73b2618090",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "d8e64ffab01e032ae29159d27230ace8cf8bdc80",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "2636569ea7c19d9a40db4a1e8d0a027bdacf1569",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "701347e31aa607f3782403151a3125729d685275",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "a2074f86fc9653831e4fb7b711bb715db330f182",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "lessThan": "6a8024511ddf4877435c34fb3d6028aa8e590649",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "lib/test_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.8",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.8",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.270",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.221",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2636569ea7c19d9a40db4a1e8d0a027bdacf1569",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/50606ced303782f8715e2d0b98ca374ea498fa29",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/541a67f21ab807c8dbc0ea88d5a2eb73b2618090",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6a8024511ddf4877435c34fb3d6028aa8e590649",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/701347e31aa607f3782403151a3125729d685275",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a2074f86fc9653831e4fb7b711bb715db330f182",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d8e64ffab01e032ae29159d27230ace8cf8bdc80",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}