CVE-2026-93217

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the madvise cold or pageout pte range() function where the pmd trans huge lock() mechanism incorrectly handles device-private Page Middle Directories (PMDs). When a device-private PMD is encountered, the !pmd present() branch triggers a VM BUG ON() assertion, which causes a system panic. This can be triggered by a race condition between an HMM-based GPU driver and madvise(MADV COLD) or MADV PAGEOUT calls, specifically when migrate vma pages() changes a PMD to a device-private entry after pmd trans huge(*pmd) returns true but before the PMD lock is acquired.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.