CVE-2026-90391 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
A local attacker can cause an infinite loop in the Linux kernel's HMM test driver by triggering a fault on an exited memory map, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90391?
CVE-2026-90391 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
dmirror_fault() is called from the dmirror_read() and dmirror_write() retry loops after dmirror_do_read() or dmirror_do_write() finds a missing device page table entry.
If the mirrored mm has already exited, mmget_not_zero() fails. The current code returns 0 in that case, which tells the caller that faulting succeeded even though no page was faulted and no device page table entry was installed. The caller then retries the same address, hits -ENOENT again, and can loop forever without making progress.
Return -EFAULT instead, so the ioctl fails when the mirrored mm is no longer faultable.
Which versions are affected by CVE-2026-90391?
How do I fix CVE-2026-90391?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90391 being exploited?
There is no known exploitation of CVE-2026-90391 in the wild and no public exploit code.
Sources
Also known as AZL-102867, BELL-CVE-2026-90391, DEBIAN-CVE-2026-90391, GHSA-q8fg-m6xh-5pw6, UBUNTU-CVE-2026-90391.