Description

In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other ->huge_fault handlers have similar checks and the resulting mapping will trigger a VM_BUG_ON_VMA() if it ever reaches copy_pmd_range().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:14.337Z",
  "pubdate": "2026-08-26T15:17:14.337Z",
  "executiveSummary": "This vulnerability involves an improper boundary check within the Linux kernel's drm/shmem_helper module during the handling of transparent huge page (THP) mappings.\nThe vulnerability resides in the ->huge_fault handler, which failed to validate whether a requested PMD (Page Middle Directory) mapping remained within the defined boundaries of the Virtual Memory Area (VMA).\nAn unprivileged local attacker could potentially exploit this flaw to trigger a kernel panic or a VM_BUG_ON_VMA() condition, leading to a Denial of Service (DoS) state.\nThe impact is primarily centered on system stability. By crafting memory mapping operations that exceed VMA boundaries, an attacker can induce a kernel crash when the kernel's mm subsystem subsequently attempts to copy or manage the malformed page ranges.\nSuccessful exploitation requires local access to the system and the ability to interact with the DRM (Direct Rendering Manager) subsystem, typically through ioctls associated with GPU drivers or shared memory objects.\nThe vulnerability highlights a critical oversight in memory management consistency checks within the DRM helper functions, necessitating immediate synchronization with established kernel memory mapping protocols to prevent illegal page table entries.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a boundary validation mechanism in the drm/shmem_helper ->huge_fault handler when creating PMD-backed mappings. In the Linux kernel, a PMD mapping facilitates the use of transparent huge pages, which map large contiguous physical memory areas into a process's virtual address space to reduce TLB pressure.\nWhen a fault occurs that necessitates a PMD mapping, the ->huge_fault handler is invoked. The implementation within drm/shmem_helper failed to verify if the size of the huge page requested would extend past the end address of the target VMA. This boundary check is a mandatory requirement for kernel memory management to ensure that page table entries remain contained within the virtual memory descriptor provided to the process.\nThe exploitation flow initiates when a user-space application invokes a memory-mapping operation (such as mmap on a DRM-backed file descriptor) that triggers a huge page fault. If the application intentionally defines a VMA alignment or size that overlaps with an adjacent VMA or crosses the VMA boundary, the lack of a boundary check allows the ->huge_fault handler to populate the PMD entry based on the physical backing of the shared memory object regardless of the VMA's constraints.\nThis malformed mapping introduces inconsistency within the process's page tables. When the kernel reaches functions like copy_pmd_range() during operations such as process forking (fork) or specific memory management system calls (madvise, munmap), it assumes that all PMD entries are inherently valid and bounded by the VMA. Encountering a PMD entry that crosses a boundary triggers a VM_BUG_ON_VMA() assertion.\nThe VM_BUG_ON_VMA() macro is designed to trap internal kernel state inconsistencies. When triggered, it invokes a kernel panic, effectively halting the system to prevent memory corruption. Because this mechanism is triggered during critical MM operations, it provides a reliable vector for a local Denial of Service (DoS).\nThis flaw is specific to kernel drivers utilizing the drm_gem_shmem_object helper infrastructure. It does not require network exposure, but it does require the ability to allocate or manipulate shared memory buffers managed by the DRM subsystem. No authentication is bypassed; rather, the vulnerability exploits the intended functionality of the memory management subsystem in an edge-case scenario where input validation is insufficient."
}