CVE-2026-46280
published 2026-06-08CVE-2026-46280: In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
lib: test_hmm: evict device pages on file close to avoid use-after-free
Patch series "Minor hmm_test fixes and cleanups".
Two bugfixes a cleanup for the HMM kernel selftests. These were mostly
reported by Zenghui Yu with special thanks to Lorenzo for analysing and
pointing out the problems.
This patch (of 3):
When dmirror_fops_release() is called it frees the dmirror struct but
doesn't migrate device private pages back to system memory first. This
leaves those pages with a dangling zone_device_data pointer to the freed
dmirror.
If a subsequent fault occurs on those pages (eg. during coredump) the
dmirror_devmem_fault() callback dereferences the stale pointer causing a
kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64,
where a test failure triggered SIGABRT and the resulting coredump walked
the VMAs faulting in the stale device private pages.
Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in
dmirror_fops_release() to migrate all device private pages back to system
memory before freeing the dmirror struct. The function is moved earlier
in the file to avoid a forward declaration.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= b2ef9f5a5cb37643ca5def3516c546457074b882 < 234071b4318feaeb27cd2e4e1b16ef6b055adf89 | 234071b4318feaeb27cd2e4e1b16ef6b055adf89 |
| linux | linux | >= b2ef9f5a5cb37643ca5def3516c546457074b882 < bf477abd448c76bb8ea51c9b4f63a3a17c4b6239 | bf477abd448c76bb8ea51c9b4f63a3a17c4b6239 |
| linux | linux | >= b2ef9f5a5cb37643ca5def3516c546457074b882 < 5846715b6382dd4c6a69b35a56ca6115d33bc2a0 | 5846715b6382dd4c6a69b35a56ca6115d33bc2a0 |
| linux | linux | >= b2ef9f5a5cb37643ca5def3516c546457074b882 < 38f113f81d3f0adc658a4475dd3ecaec985e21d3 | 38f113f81d3f0adc658a4475dd3ecaec985e21d3 |
| linux | linux | >= b2ef9f5a5cb37643ca5def3516c546457074b882 < 9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1 | 9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1 |
| linux | linux | >= b2ef9f5a5cb37643ca5def3516c546457074b882 < 744dd97752ef1076a8d8672bb0d8aa2c7abc1144 | 744dd97752ef1076a8d8672bb0d8aa2c7abc1144 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.8 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.27 | 6.18.27 |
| linux | linux_kernel | >= 6.19 < 7.0.4 | 7.0.4 |
| linux | linux_kernel | >= 6.2 < 6.6.140 | 6.6.140 |
| linux | linux_kernel | >= 6.7 < 6.12.86 | 6.12.86 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oem-7.0 | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 8.8
CVE-2026-46042 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a container. (C
Red Hat
kernel: lib: test_hmm: evict device pages on file close to avoid use-after-free
vendor_redhat·2026-06-08·CVSS 5.5
CVE-2026-46280 [MEDIUM] CWE-825 kernel: lib: test_hmm: evict device pages on file close to avoid use-after-free
kernel: lib: test_hmm: evict device pages on file close to avoid use-after-free
A flaw was found in the Linux kernel's Heterogeneous Memory Management (HMM) test module. When a device mirror (dmirror) structure is freed, its associated device private pages are not properly migrated back to system memory. This can lead to a use-after-free condition where a dangling pointer to the freed dmirror is dereferenced, potentially causing a kernel panic. A local attacker could exploit this to trigger a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterpri
VulDB
Linux Kernel up to 6.6.139/6.12.85/6.18.26/7.0.3 lib mm/ksft_hmm.sh dmirror_fops_release use after free (Nessus ID 319687)
vuldb·2026-06-08
CVE-2026-46280 [CRITICAL] Linux Kernel up to 6.6.139/6.12.85/6.18.26/7.0.3 lib mm/ksft_hmm.sh dmirror_fops_release use after free (Nessus ID 319687)
A vulnerability was found in Linux Kernel up to 6.6.139/6.12.85/6.18.26/7.0.3. It has been declared as critical. This affects the function dmirror_fops_release of the file mm/ksft_hmm.sh of the component lib. Executing a manipulation can lead to use after free.
This vulnerability is handled as CVE-2026-46280. The attack can only be done within the local network. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups".
ghsa_unreviewed·2026-06-08
CVE-2026-46280 In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups".
In the Linux kernel, the following vulnerability has been resolved:
lib: test_hmm: evict device pages on file close to avoid use-after-free
Patch series "Minor hmm_test fixes and cleanups".
Two bugfixes a cleanup for the HMM kernel selftests. These were mostly
reported by Zenghui Yu with special thanks to Lorenzo for analysing and
pointing out the problems.
This patch (of 3):
When dmirror_fops_release() is called it frees the dmirror struct but
doesn't migrate device private pages back to system memory first. This
leaves those pages with a dangling zone_device_data pointer to the freed
dmirror.
If a subsequent fault occurs on those pages (eg. during coredump) the
dmirror_devmem_fault() callback dereferences the stale pointer causing a
kernel panic. This was reported [1] when running
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/234071b4318feaeb27cd2e4e1b16ef6b055adf89https://git.kernel.org/stable/c/38f113f81d3f0adc658a4475dd3ecaec985e21d3https://git.kernel.org/stable/c/5846715b6382dd4c6a69b35a56ca6115d33bc2a0https://git.kernel.org/stable/c/744dd97752ef1076a8d8672bb0d8aa2c7abc1144https://git.kernel.org/stable/c/9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1https://git.kernel.org/stable/c/bf477abd448c76bb8ea51c9b4f63a3a17c4b6239
2026-06-08
Published