---
id: CVE-2026-46277
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/zone_device: do not touch device folio after calling ->folio_free()

  The contents of a device folio can immediately change after calling
  ->folio_free(), as the folio…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/zone_device: do not touch device folio after calling ->folio_free()

  The contents of a device folio can immediately change after calling
  ->folio_free(), as the folio…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-06-08'
updated: '2026-07-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46277'
references:
  - url: 'https://git.kernel.org/stable/c/39928984956037cabd304321cb8f342e47421db5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85be0a262e39c706edb53c88af8afde2e98222ba'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0012
epssPercentile: 0.02137
ingestedAt: '2026-07-07T18:42:24.260Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/zone_device: do not touch device folio after calling ->folio_free()

The contents of a device folio can immediately change after calling
->folio_free(), as the folio may be reallocated by a driver with a
different order.  Instead of touching the folio again to extract the
pgmap, use the local stack variable when calling percpu_ref_put_many().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.