VulnerabilityPublished 24 Sep 2026Updated 19 Oct 2026

CVE-2026-93217: Linux kernel · mm/madvise: skip device-private PMDs in cold and pageout walks

Affects Linux kernelSource CVE Database V5

Not known to be exploited : upgrade to d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2 or 5c0d7b658cda62cd17cb3652783386d5608030ef soon.

Data as of 26 Oct 2026, 14:02 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2, 5c0d7b658cda62cd17cb3652783386d5608030ef

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2 or 5c0d7b658cda62cd17cb3652783386d5608030ef.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 368076f52ebeecd33e10a9f80905d7508b6b6149, < d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2	Fixed in d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2
LinuxLinux	Affected ≥ 368076f52ebeecd33e10a9f80905d7508b6b6149, < 5c0d7b658cda62cd17cb3652783386d5608030ef	Fixed in 5c0d7b658cda62cd17cb3652783386d5608030ef
LinuxLinux	Affected =6.19	Fixed in–

AI-suggested

A fix has been implemented and merged into the Linux kernel source (commits d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2 and 5c0d7b658cda62cd17cb3652783386d5608030ef). Users and administrators should update to the patched kernel version 6.19 or later containing these commits to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's memory management subsystem involving device-private Page Middle Directories (PMDs) during madvise cold and pageout walks has been fixed. The issue arises when madvise_cold_or_pageout_pte_range() incorrectly handles device-private PMDs, causing a kernel assertion failure (VM_BUG_ON) due to unexpected non-present PMDs. This can occur when an HMM-based GPU driver races with madvise calls, leading to a potential kernel panic. The fix involves skipping device-private PMDs in the relevant code path and downgrading the assertion to a warning to prevent panics.

Impact

The vulnerability can cause a kernel panic due to an unexpected assertion failure when device-private PMDs are encountered during madvise cold or pageout walks. This can lead to system instability or denial of service on affected Linux kernel versions, particularly when using HMM-based GPU drivers that race with madvise operations.

Summary

The Linux kernel vulnerability CVE-2026-93217 concerns the handling of device-private PMDs in the madvise cold and pageout memory walks. The function madvise_cold_or_pageout_pte_range() takes a lock on huge PMDs and checks if the PMD is huge, which returns true for device-private PMDs. However, the subsequent code expects only migration entries to be non-present, triggering a VM_BUG_ON assertion if a device-private PMD is encountered, causing a kernel panic. This situation can be triggered by a race condition where an HMM-based GPU driver changes a PMD to a device-private entry concurrently with madvise calls. The patch skips device-private PMDs in the non-present branch, replaces the panic assertion with a warning, and removes a redundant configuration guard, thereby preventing kernel panics caused by this race condition.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 14:02 UTC

Technical details

References

Community reviews

Related threats