VulnerabilityPublished 24 Sep 2026Updated 19 Oct 2026

CVE-2026-93218: Linux kernel · mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

Affects Linux kernelSource CVE Database V5

Not known to be exploited : upgrade to ce579dcf730ce5ed8043a5eeea18a3e6706a97e5 or 5e3026bf736498115884d6c7bd0308ba29e0474c when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ce579dcf730ce5ed8043a5eeea18a3e6706a97e5, 5e3026bf736498115884d6c7bd0308ba29e0474c

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to ce579dcf730ce5ed8043a5eeea18a3e6706a97e5 or 5e3026bf736498115884d6c7bd0308ba29e0474c.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 368076f52ebeecd33e10a9f80905d7508b6b6149, < ce579dcf730ce5ed8043a5eeea18a3e6706a97e5	Fixed in ce579dcf730ce5ed8043a5eeea18a3e6706a97e5
LinuxLinux	Affected ≥ 368076f52ebeecd33e10a9f80905d7508b6b6149, < 5e3026bf736498115884d6c7bd0308ba29e0474c	Fixed in 5e3026bf736498115884d6c7bd0308ba29e0474c
LinuxLinux	Affected =6.19	Fixed in–

AI-suggested

A fix has been implemented and is available in the Linux kernel commits ce579dcf730ce5ed8043a5eeea18a3e6706a97e5 and 5e3026bf736498115884d6c7bd0308ba29e0474c. Users and administrators should update to the patched kernel version 6.19 or later containing these commits to remediate the issue.

Description

A vulnerability in the Linux kernel's memory management subsystem involving device-private Page Middle Directories (PMDs) in the madvise_free_huge_pmd function has been resolved. The issue arises due to a race condition where an HMM-based GPU driver can change a PMD to a device-private entry during madvise(MADV_FREE) processing, potentially causing incorrect handling of PMDs. The fix involves skipping device-private PMDs in a specific code branch and downgrading certain checks to warnings to prevent kernel panics.

Impact

The vulnerability could cause kernel instability or panics due to improper handling of device-private PMDs during madvise(MADV_FREE) operations, especially when racing with HMM-based GPU drivers. This may affect system reliability but there is no indication of direct privilege escalation or data corruption from the provided data.

Summary

CVE-2026-93218 addresses a flaw in the Linux kernel's huge memory management where madvise_free_huge_pmd incorrectly handles device-private PMDs. The function madvise_free_pte_range() checks pmd_trans_huge() without locking, while madvise_free_huge_pmd() takes the lock later. Because pmd_is_huge() returns true for device-private PMDs, orig_pmd can be device-private and enter a branch intended for non-present PMDs, leading to potential misuse of pmd_folio(). The vulnerability can be triggered by a race condition where an HMM-based GPU driver migrates pages and flips the PMD to a device-private entry between the initial check and the lock acquisition. The patch skips device-private PMDs in this branch, changes a panic-inducing check to a warning, and removes a redundant guard, improving stability and correctness.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 14:02 UTC

Technical details

References

Community reviews

Related threats