CVE-2026-46280: lib: test_hmm: evict device pages on file close to avoid use-after-free
Vulnerability summary
CVE-2026-46280 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 21 · Related 21Timeline
- 08-06-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages. Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Decrease -0.04 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu147 products
- linuxAll versions (No fix recorded) | < 6.8.0-136.136 | < 7.0.0-27.27
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1061.64 | < 7.0.0-1008.8
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ b2ef9f5a5cb37643ca5def3516c546457074b882, < 234071b4318feaeb27cd2e4e1b16ef6b055adf89 | ≥ b2ef9f5a5cb37643ca5def3516c546457074b882, < bf477abd448c76bb8ea51c9b4f63a3a17c4b6239 | ≥ b2ef9f5a5cb37643ca5def3516c546457074b882, < 5846715b6382dd4c6a69b35a56ca6115d33bc2a0 | ≥ b2ef9f5a5cb37643ca5def3516c546457074b882, < 38f113f81d3f0adc658a4475dd3ecaec985e21d3 | ≥ b2ef9f5a5cb37643ca5def3516c546457074b882, < 9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1 | ≥ b2ef9f5a5cb37643ca5def3516c546457074b882, < 744dd97752ef1076a8d8672bb0d8aa2c7abc1144 | 5.8
- linux_kernel≥ 5.8, < 6.1.176 | ≥ 6.2, < 6.6.140 | ≥ 6.7, < 6.12.86 | ≥ 6.13, < 6.18.27 | ≥ 6.19, < 7.0.4
Debian1 product
- linux< 6.1.176-1 | < 6.12.86-1 | < 7.0.4-1
3 vendors · 150 products
