---
id: CVE-2026-89967
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/migrate_device: avoid out-of-bounds writes for compound folios

  migrate_device_range() and migrate_device_pfns() clear the entries
  following a compound folio so that…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/migrate_device: avoid out-of-bounds writes for compound folios

  migrate_device_range() and migrate_device_pfns() clear the entries
  following a compound folio so that…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a30b48bf1b244f11bf9b6d20cdccfe0c2264130c <
    99186b185c245f5987d7f8715d5504c8d8cc04a0
  - >-
    Linux >= a30b48bf1b244f11bf9b6d20cdccfe0c2264130c <
    dc41e961a269f2ca4196e669d6d8e05480899cd4
  - Linux 6.19
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:20.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89967'
references:
  - url: 'https://git.kernel.org/stable/c/99186b185c245f5987d7f8715d5504c8d8cc04a0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dc41e961a269f2ca4196e669d6d8e05480899cd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.958Z'
epss: 0.00154
epssPercentile: 0.04929
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: avoid out-of-bounds writes for compound folios

migrate_device_range() and migrate_device_pfns() clear the entries
following a compound folio so that the PFN arrays retain their
page-granular representation.

If a compound folio extends beyond the end of the caller-provided range,
the loops clear all following folio entries without limiting them to the
number of slots remaining in the npages-sized array, causing an
out-of-bounds write.

Do not proceed with a compound folio if its page-granular representation
does not fit entirely in the remaining PFN array.  If this happens, drop
any reference and lock acquired for the folio, clear the remaining
entries, and stop collecting.

Observed with a KASAN x86 QEMU kernel using the HMM migrate_anon_huge_zero
selftest.  Closing /dev/hmm_dmirror0 after migrating an anonymous huge
page to device memory exercises:

  dmirror_fops_release()
    -> dmirror_device_evict_chunk()
      -> migrate_device_range()

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.