CVE-2026-68163: mm/page_vma_mapped: fix device-private PMD handling

CVE-2026-68163: mm/page_vma_mapped: fix device-private PMD handling

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/page_vma_mapped: fix device-private PMD handling

Commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support
device-private entries") introduced the concept of device-private PMD
entries, but did not correctly update the rmap walk code to account for
them.

As a result, when page_vma_mapped_walk() encounters device-private PMD
entries, it takes no action other than to acquire the PMD lock and exit.

However this is highly problematic for two reasons - firstly, device
private entries possess a PFN so check_pmd() needs to be called to ensure
an overlapping PFN range.

Secondly, and more importantly, if PVMW_MIGRATION is set the caller
assumes the returned entry is a migration entry, resulting in memory
corruption when the caller tries to interpret the device private entry as
such.

In addition, commit 146287290023 ("mm/huge_memory: implement
device-private THP splitting") allowed device private PMDs to be split
like THP mappings, but again did not update this code path.

As a result, we might race a PMD split prior to acquiring the PMD lock.

This patch addresses all of these issues by invoking check_pmd(), ensuring
PMVW_MIGRATION is not set and checks whether a split raced us we do for
PMD THP and migration entries.

Instead of checking for a subset of the cases after taking the pmd_lock(),
put device-private along with pmd_trans_huge() and
pmd_is_migration_entry().  Also remove thp_migration_supported() as it is
already guarded by pmd_is_migration_entry().

[akpm@linux-foundation.org: fix Raspberry Pi 1 build, per David]

The Linux kernel CVE team has assigned CVE-2026-68163 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.19 with commit 65edfda6f3f2e58f757485a056e4f1775a1404a8 and fixed in 7.1.6 with commit ab6209f4b48a98ef14d6766acdb62aa9bb32e670
	Issue introduced in 6.19 with commit 65edfda6f3f2e58f757485a056e4f1775a1404a8 and fixed in 7.2-rc5 with commit f84ca9b1888d8fce7dfefe0e750fa971f8797486

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68163
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/page_vma_mapped.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ab6209f4b48a98ef14d6766acdb62aa9bb32e670
	https://git.kernel.org/stable/c/f84ca9b1888d8fce7dfefe0e750fa971f8797486