122 lines
7.7 KiB
JSON
122 lines
7.7 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-53155",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-06-09T07:44:35.388Z",
|
|
"datePublished": "2026-06-25T08:38:38.828Z",
|
|
"dateUpdated": "2026-06-25T08:38:38.828Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-06-25T08:38:38.828Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: use correct flags for device private PMD entry\n\nCommit 65edfda6f3f2 (\"mm/rmap: extend rmap and migration support\ndevice-private entries\") updated set_pmd_migration_entry() to use\npmdp_huge_get_and_clear() in the softleaf case, but made no further\nadjustments to the function itself.\n\nTherefore this function continues to incorrectly use pmd_write(),\npmd_soft_dirty() and pmd_uffd_wp() to determine whether the installed\nmigration entry should be marked writable, softdirty or uffd-wp\nrespectively.\n\nWhilst all are incorrect, the most problematic of these is pmd_write(), as\nthis can lead to corrupted rmap state.\n\nOn x86-64 _PAGE_SWP_SOFT_DIRTY is aliased to _PAGE_RW. So calling\npmd_write() on a softleaf will return the softdirty state encoded in the\nentry, assuming CONFIG_MEM_SOFT_DIRTY was enabled.\n\nThis was observed when running the hmm.hmm_device_private.anon_write_child\nselftest:\n\n1. The test faults in a range then migrates it such that a device-private\n THP range is established.\n\n2. The parent then migrates it to a device-private writable PMD entry whose\n folio is entirely AnonExclusive with entire_mapcount=1, softdirty set\n (accidentally correct write state).\n\n3. The parent forks and the PMD entries are set to device-private read only\n entries, entire_mapcount=2, softdirty still set.\n\n4. [BUG] The child writes to the range then migrates to RAM - intending to\n install non-writable migration entries - but replacing parent and child\n PMD mappings with WRITABLE entries due to misinterpreting the softdirty\n bit.\n\n5. In remove_migration_pmd(), if !softleaf_is_migration_read(entry) we\n set the RMAP_EXCLUSIVE flag when calling folio_add_anon_rmap_pmd() for\n both parent and child, which are therefore AnonExclusive.\n\n6. [SPLAT] Child sets migrated folio entire_mapcount=1, parent sets\n entire_mapcount=2 and we end up with an AnonExclusive folio with\n entire_mapcount=2! Assert fires in __folio_add_anon_rmap():\n\n\t\tVM_WARN_ON_FOLIO(folio_test_large(folio) &&\n\t\t\t\t folio_entire_mapcount(folio) > 1 &&\n\t\t\t\t PageAnonExclusive(cur_page), folio)\n\nThis patch fixes the issue by correctly referencing the softleaf entry\nfields for writable, softdirty and uffd-wp in set_pmd_migration_entry().\n\nIt also only updates A/D flags if the entry is present as these are\notherwise not meaningful for a softleaf entry.\n\nThis patch also flips the if (!present) { ... } else { ... } logic in\nset_pmd_migration_entry() so it is easier to understand, and adds some\ncomments to make things clearer.\n\nI was able to bisect this to commit 775465fd26a3 (\"lib/test_hmm: add zone\ndevice private THP test infrastructure\") which first exposes this bug as\nit was the commit that permitted test_hmm to generate the test.\n\nHowever commit 65edfda6f3f2 (\"mm/rmap: extend rmap and migration support\ndevice-private entries\") is the commit that actually enabled this\nbehaviour."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/huge_memory.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "65edfda6f3f2e58f757485a056e4f1775a1404a8",
|
|
"lessThan": "d7251c8d3f7cea76543abac6cf4ed15582c10846",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "65edfda6f3f2e58f757485a056e4f1775a1404a8",
|
|
"lessThan": "43e7f189769c512c843184a8a5892ac779a6bd90",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/huge_memory.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.13",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.19",
|
|
"versionEndExcluding": "7.0.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.19",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d7251c8d3f7cea76543abac6cf4ed15582c10846"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/43e7f189769c512c843184a8a5892ac779a6bd90"
|
|
}
|
|
],
|
|
"title": "mm/huge_memory: use correct flags for device private PMD entry",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |