In the Linux kernel, the following vulnerability has been resolved:
mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
Patch series "mm: fixes for device-exclusive entries (hmm)", v2.
Discussing the PageTail() call in make_device_exclusive_range() with Willy, I recently discovered [1] that device-exclusive handling does not properly work with THP, making the hmm-tests selftests fail if THPs are enabled on the system.
Looking into more details, I found that hugetlb is not properly fenced, and I realized that something that was bugging me for longer -- how device-exclusive entries interact with mapcounts -- completely breaks migration/swapout/split/hwpoison handling of these folios while they have device-exclusive PTEs.
The program below can be used to allocate 1 GiB worth of pages and making them device-exclusive on a kernel with CONFIG_TEST_HMM.
Once they are device-exclusive, these folios cannot get swapped out (proc$pid/smaps_rollup will always indicate 1 GiB RSS no matter how much one forces memory reclaim), and when having a memory block onlined to ZONE_MOVABLE, trying to offline it will loop forever and complain about failed migration of a page that should be movable.
# echo offline > /sys/devices/system/memory/memory136/state # echo online_movable > /sys/devices/system/memory/memory136/state # ./hmm-swap & ... wait until everything is device-exclusive # echo offline > /sys/devices/system/memory/memory136/state [ 285.193431][T14882] page: refcount:2 mapcount:0 mapping:0000000000000000 index:0x7f20671f7 pfn:0x442b6a [ 285.196618][T14882] memcg:ffff888179298000 [ 285.198085][T14882] anon flags: 0x5fff0000002091c(referenced|uptodate| dirty|active|owner_2|swapbacked|node=1|zone=3|lastcpupid=0x7ff) [ 285.201734][T14882] raw: ... [ 285.204464][T14882] raw: ... [ 285.207196][T14882] page dumped because: migration failure [ 285.209072][T14882] page_owner tracks the page as allocated [ 285.210915][T14882] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), id 14926, tgid 14926 (hmm-swap), ts 254506295376, free_ts 227402023774 [ 285.216765][T14882] post_alloc_hook+0x197/0x1b0 [ 285.218874][T14882] get_page_from_freelist+0x76e/0x3280 [ 285.220864][T14882] __alloc_frozen_pages_noprof+0x38e/0x2740 [ 285.223302][T14882] alloc_pages_mpol+0x1fc/0x540 [ 285.225130][T14882] folio_alloc_mpol_noprof+0x36/0x340 [ 285.227222][T14882] vma_alloc_folio_noprof+0xee/0x1a0 [ 285.229074][T14882] __handle_mm_fault+0x2b38/0x56a0 [ 285.230822][T14882] handle_mm_fault+0x368/0x9f0 ...
This series fixes all issues I found so far. There is no easy way to fix without a bigger rework/cleanup. I have a bunch of cleanups on top (some previous sent, some the result of the discussion in v1) that I will send out separately once this landed and I get to it.
I wish we could just use some special present PROT_NONE PTEs instead of these (non-present, non-none) fake-swap entries; but that just results in the same problem we keep having (lack of spare PTE bits), and staring at other similar fake-swap entries, that ship has sailed.
With this series, make_device_exclusive() doesn't actually belong into mm/rmap.c anymore, but I'll leave moving that for another day.
I only tested this series with the hmm-tests selftests due to lack of HW, so I'd appreciate some testing, especially if the interaction between two GPUs wanting a device-exclusive entry works as expected.
<program> #include <stdio.h> #include <fcntl.h> #include <stdint.h> #include <unistd.h> #include <stdlib.h> #include <string.h> #include <sys/mman.h> #include <sys/ioctl.h> #include <linux/types.h> #include <linux/ioctl.h>
#define HMM_DMIRROR_EXCLUSIVE _IOWR('H', 0x05, struct hmm_dmirror_cmd)
struct hmm_dmirror_cmd { __u64 addr; __u64 ptr; __u64 npages; __u64 cpages; __u64 faults; };
const size_t size = 1 * 1024 * 1024 * 1024ul; const size_t chunk_size = 2 * 1024 * 1024ul;
int m ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade kernel6.12Upgrade perf6.12Upgrade kernel-livepatch-6.12.23-29.97Upgrade kernel-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftoolUpgrade perf6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade kernel-libbpf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-tools-debuginfoUpgrade python3-perf6.12Upgrade kernel-develUpgrade kernel-tools | Jun 24, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | — | Jul 9, 2025 | Apr 16, 2025 |
| Suse | — | Upgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade dtb-exynosUpgrade cluster-md-kmp-64kbUpgrade dtb-renesasUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatchUpgrade kernel-obs-buildUpgrade dtb-allwinnerUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade ocfs2-kmp-64kbUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-rt-develUpgrade kernel-rt-livepatchUpgrade dtb-mediatekUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-64kb-develUpgrade dtb-freescaleUpgrade dtb-lgUpgrade kernel-default-develUpgrade kernel-macrosUpgrade dtb-armUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-64kbUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-rockchipUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-qaUpgrade dtb-apmUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-docsUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-sourceUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-rtUpgrade dtb-socionextUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade dtb-marvellUpgrade dtb-broadcom | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-realtimeUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-6.11Upgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-gcp-64kUpgrade linux-image-awsUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-azure-fde-6.11Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-azureUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-gcpUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-aws-64kUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-azure-fde-edgeUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-azure-6.11Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1007-oracle-64k | Jun 26, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub