CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: skip non-present PMDs when queueing folios

Patch series "mm: handle device-private PMDs in walk callbacks", v3.

Since commit 368076f52ebe ("mm/huge memory: add device-private THP support to PMD operations") a PMD may hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate vma pages().

pmd trans huge lock() succeeds for such PMDs (pmd is huge() returns true for any non-present, non-none huge PMD), so several MM walk callbacks that used to assume present THP or migration entry are now reachable with a device-private PMD. The results range from a VM BUG ON() firing on debug kernels, to an oops on a bogus vmemmap dereference, to silently isolating an unrelated live folio from LRU in the aliasing case.

This patch (of 3):

queue folios pmd() is called under pmd trans huge lock(), whose pmd is huge() check returns true for any non-present, non-none PMD softleaf. Passing such a PMD to pmd folio() treats the softleaf encoding as a hardware PFN and can return a bogus folio pointer.

Mirror queue folios pte range(): handle non-present entries before looking up a folio. Keep migration entries counted as failures, but skip other non-present PMDs such as device-private entries.

Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio to device memory via migrate vma pages(), leaving a device-private PMD. Userspace then calls mbind(), migrate pages() or set mempolicy home node() on that range.