CVE-2026-89967

7.8 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability allows out-of-bounds writes when handling compound folios, which could lead to data corruption or exploitation if not properly mitigated.
Exploitability: Exploitation requires specific conditions, such as handling large compound folios beyond the caller-provided range, making it somewhat difficult but not impossible.
Blast radius: If exploited, the impact could be significant, potentially leading to system instability or security vulnerabilities.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the fixed version 5.19.10 or later.

kernelmemoryout-of-boundspatch

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: avoid out-of-bounds writes for compound folios migrate_device_range() and migrate_device_pfns() clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compound folio extends beyond the end of the caller-provided range, the loops clear all following folio entries without limiting them to the number of slots remaining in the npages-sized array, causing an out-of-bounds write. Do not proceed with a compound folio if its page-granular representation does not fit entirely in the remaining PFN array. If this happens, drop any reference and lock acquired for the folio, clear the remaining entries, and stop collecting. Observed with a KASAN x86 QEMU kernel using the HMM migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after migrating an anonymous huge page to device memory exercises: dmirror_fops_release() -> dmirror_device_evict_chunk() -> migrate_device_range()

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.