CVE-2026-80686

In the Linux kernel, the following vulnerability has been resolved: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from pte_pfn() or incorrect dirty folio accounting from pte_dirty(). Fix both by guarding with pte_present() checks.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/26f9ca8ed42cba25d2c75daff13561cce6019395
https://git.kernel.org/stable/c/2be94d6b20789b8865b1864dae5fe458ca85e019
https://git.kernel.org/stable/c/42f30fa5481a1f90571ccdfbb20d2e25e47ae76e
https://git.kernel.org/stable/c/5b948706f11a950bc73c5304630d0a7eafc40daf
https://git.kernel.org/stable/c/63867c82d0c0c2d182016a32b1cc0103116b0ea5
https://git.kernel.org/stable/c/86d55447de3738620b9a8272ff167ce97e7f7203

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-28 08:16

Updated : 2026-08-28 08:16

NVD link : CVE-2026-80686

Mitre link : CVE-2026-80686

CVE.ORG link : CVE-2026-80686

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80686", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6c287605fd56466e645693eff3ae7c08fba56e0a", "lessThan": "26f9ca8ed42cba25d2c75daff13561cce6019395", "versionType": "git"}, {"status": "affected", "version": "6c287605fd56466e645693eff3ae7c08fba56e0a", "lessThan": "5b948706f11a950bc73c5304630d0a7eafc40daf", "versionType": "git"}, {"status": "affected", "version": "6c287605fd56466e645693eff3ae7c08fba56e0a", "lessThan": "86d55447de3738620b9a8272ff167ce97e7f7203", "versionType": "git"}, {"status": "affected", "version": "6c287605fd56466e645693eff3ae7c08fba56e0a", "lessThan": "2be94d6b20789b8865b1864dae5fe458ca85e019", "versionType": "git"}, {"status": "affected", "version": "6c287605fd56466e645693eff3ae7c08fba56e0a", "lessThan": "42f30fa5481a1f90571ccdfbb20d2e25e47ae76e", "versionType": "git"}, {"status": "affected", "version": "6c287605fd56466e645693eff3ae7c08fba56e0a", "lessThan": "63867c82d0c0c2d182016a32b1cc0103116b0ea5", "versionType": "git"}], "programFiles": ["mm/migrate_device.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"status": "unaffected", "version": "0", "lessThan": "5.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/migrate_device.c"], "defaultStatus": "affected"}]}], "published": "2026-08-28T08:16:54.067", "references": [{"url": "https://git.kernel.org/stable/c/26f9ca8ed42cba25d2c75daff13561cce6019395", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2be94d6b20789b8865b1864dae5fe458ca85e019", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/42f30fa5481a1f90571ccdfbb20d2e25e47ae76e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5b948706f11a950bc73c5304630d0a7eafc40daf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/63867c82d0c0c2d182016a32b1cc0103116b0ea5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/86d55447de3738620b9a8272ff167ce97e7f7203", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE\n\npte_pfn() and pte_dirty() have undefined behaviour when called on a\nnon-present PTE. In migrate_vma_collect_pmd(), these functions may be\ninvoked on non-present entries (e.g., device-private entries), leading\nto potential crashes from pte_pfn() or incorrect dirty folio accounting\nfrom pte_dirty(). Fix both by guarding with pte_present() checks."}], "lastModified": "2026-08-28T08:16:54.067", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}