Description

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page information if it is called afterward. Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() so the pages array remains valid during DMA unmapping.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T17:17:09.587Z",
  "pubdate": "2026-09-24T17:17:09.587Z",
  "executiveSummary": "This vulnerability involves an improper execution order in the Linux kernel's DRM pagemap migration logic, leading to a resource management flaw.\nThe issue is classified as a use-after-cleanup defect where critical DMA unmapping operations are bypassed or invalidated due to premature state clearing.\nThe vulnerability affects the Linux kernel's DRM subsystem, specifically within the page migration error handling path.\nThe risk implication involves potential memory management inconsistencies and improper DMA resource release, which could lead to system instability, memory corruption, or potentially exploitable kernel states.\nSuccessful exploitation requires the system to trigger a specific migration error path in the DRM driver. An attacker capable of inducing controlled memory pressure or hardware-specific migration failures could potentially trigger this state.\nWhile the primary impact is kernel-level instability, such vulnerabilities often provide primitives that could be leveraged for privilege escalation or denial-of-service in specific driver contexts.",
  "technicalDetails": "The root cause of this vulnerability lies in the incorrect ordering of operations within the error-handling path for page migration in the Linux kernel's DRM subsystem. Specifically, the function drm_pagemap_migrate_unmap_pages() is tasked with performing necessary DMA unmapping operations to release resources associated with the pages being migrated.\nThe mechanism relies on an array of page structures to identify which specific mappings require removal. However, the existing implementation invokes drm_pagemap_migration_unlock_put_pages() prior to the completion of the unmapping process. The function drm_pagemap_migration_unlock_put_pages() is responsible for performing cleanup tasks, which includes clearing the pages array.\nAs a result of this sequencing, drm_pagemap_migrate_unmap_pages() is invoked while the critical tracking metadata (the pages array) has already been cleared or nullified. This leads to a scenario where the kernel attempts to process DMA unmappings based on a stale or empty reference, causing the unmapping logic to either fail silently or attempt to operate on invalid memory addresses.\nThe attack flow requires an adversary to trigger a failure scenario during the DRM page migration process. By manipulating the environment or the state of the DRM device, an attacker may force the kernel into the error-handling path where this improper function call order occurs.\nThe vulnerability occurs within the interplay between page reference counting and DMA resource management. When the cleanup function executes prematurely, the reference counts for the involved pages may be dropped while active DMA mappings still point to those physical pages. This leaves the system in an inconsistent state where DMA controllers may retain stale references to memory that is no longer intended for use by the DRM subsystem or is being reallocated for other tasks.\nPost-exploitation, this can manifest as a kernel panic due to invalid memory access or, more critically, as an information leak or write primitive if the kernel reallocates the affected physical pages while the DMA controller still has access to them, leading to DMA-induced memory corruption. Because this takes place within the kernel's memory management context, it poses a significant threat to system integrity and stability."
}