CVE-2026-46280 lib: test_hmm: evict device pages on file close to avoid use-after-free
A use-after-free in the Linux kernel HMM selftests allows a local attacker to cause a kernel panic via a coredump, requiring a patch to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46280?
CVE-2026-46280 is a high-severity use after free vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
lib: test_hmm: evict device pages on file close to avoid use-after-free
Patch series "Minor hmm_test fixes and cleanups".
Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems.
This patch (of 3):
When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror.
If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages.
Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration.
Weakness: CWE-416
Which versions are affected by CVE-2026-46280?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46280?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-46280 being exploited?
There is no known exploitation of CVE-2026-46280 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-89607, BELL-CVE-2026-46280, DEBIAN-CVE-2026-46280, GHSA-vjjg-r28q-g2g4, ROOT-OS-DEBIAN-11-CVE-2026-46280, ROOT-OS-DEBIAN-12-CVE-2026-46280 and 1 more.