VulnerabilityPublished 28 Aug 2026Updated 6 Nov 2026

CVE-2026-80686: Linux kernel · mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in 63867c82d0c0c2d182016a32b1cc0103116b0ea5 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:41 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in 63867c82d0c0c2d182016a32b1cc0103116b0ea5, 86d55447de3738620b9a8272ff167ce97e7f7203, 42f30fa5481a1f90571ccdfbb20d2e25e47ae76e +3

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6c287605fd56466e645693eff3ae7c08fba56e0a, < 63867c82d0c0c2d182016a32b1cc0103116b0ea5	Fixed in 63867c82d0c0c2d182016a32b1cc0103116b0ea5
LinuxLinux	Affected ≥ 6c287605fd56466e645693eff3ae7c08fba56e0a, < 86d55447de3738620b9a8272ff167ce97e7f7203	Fixed in 86d55447de3738620b9a8272ff167ce97e7f7203
LinuxLinux	Affected ≥ 6c287605fd56466e645693eff3ae7c08fba56e0a, < 42f30fa5481a1f90571ccdfbb20d2e25e47ae76e	Fixed in 42f30fa5481a1f90571ccdfbb20d2e25e47ae76e
LinuxLinux	Affected ≥ 6c287605fd56466e645693eff3ae7c08fba56e0a, < 26f9ca8ed42cba25d2c75daff13561cce6019395	Fixed in 26f9ca8ed42cba25d2c75daff13561cce6019395
LinuxLinux	Affected ≥ 6c287605fd56466e645693eff3ae7c08fba56e0a, < 5b948706f11a950bc73c5304630d0a7eafc40daf	Fixed in 5b948706f11a950bc73c5304630d0a7eafc40daf
LinuxLinux	Affected ≥ 6c287605fd56466e645693eff3ae7c08fba56e0a, < 2be94d6b20789b8865b1864dae5fe458ca85e019	Fixed in 2be94d6b20789b8865b1864dae5fe458ca85e019

AI-suggested

A fix is available in the Linux kernel. Users should update to the fixed kernel versions identified by the commits listed in establishedFacts.fixedVersions. No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's memory management subsystem was fixed where functions pte_pfn() and pte_dirty() were called on non-present page table entries (PTEs). This could lead to kernel crashes or incorrect accounting of dirty memory pages. The issue was addressed by adding checks to ensure these functions are only called on present PTEs.

Impact

Calling pte_pfn() or pte_dirty() on non-present PTEs can cause kernel crashes or incorrect memory accounting, potentially affecting system stability and reliability. There is no indication of exploitation in the wild.

Summary

The Linux kernel had a flaw in the migrate_device code path where pte_pfn() and pte_dirty() functions were invoked on non-present PTEs, such as device-private entries. Since these functions have undefined behavior when called on non-present PTEs, this could cause kernel crashes or incorrect dirty folio accounting. The fix involved adding pte_present() checks before calling these functions in migrate_vma_collect_pmd().

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:41 UTC

Technical details

References

Community reviews

Related threats