From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 700284A013A for ; Thu, 24 Sep 2026 15:42:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790264530; cv=none; b=Mbwn/EYW98HwmeGDnUJw2UNRMZ8/4P8938QHLLV6JNpF/lrapkACsqHvZrEhLIuluqcve4bgyv7mG5hKxpk9C4QVXEr+CkLP6Ay+z411X3f2eTZcXTTZ/FBQjEpWrEDistFPHlQL5vElEtdZb70jwYE4cuyy5JZk8D8dGxNRl9w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790264530; c=relaxed/simple; bh=6T1b3FFKOXJJj+qxNuO7eSGZdDWSZaiUmswEbixu/dA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DgriFA7WJzeL5h4pMnQUdK4H2UaKH1AXwOuMVLwkn/0zRmDKi03vlIRFXwNtutiIq77gtBDvRz/NXcXQGZH8HJebQqhhvFj+hq64gJ+tCyrPXKrpO0LbMIRlW+ZRkl7AbGU+0c24RFNGzpiA+Yj61Z54yaFvLQF9w8/0AwqSOHk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xjG1dKWI; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="xjG1dKWI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2616A1F00893; Thu, 24 Sep 2026 15:42:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790264529; bh=GafiOahHwpkZuRDxSVpTqsRqOrn2H3I36vtU3Vvhnfw=; h=From:To:Cc:Subject:Date:Reply-To; b=xjG1dKWI5MfpEixaHlQR+dn1TujvYCBWVEp4jLlxXAr1gwAVnjRCL4glIGVdY/Z1d 4SAV9xZnMd942/5lxGaKDKn5OcIpYETiIzekblphPEliZ51auZ2pcYFF/WgT6zBw+f 52xVUnIM0rGMBfj50GxCPDBpUlz6phLdkZM78LpU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-93237: LoongArch: Add DIRECT_MAP_PHYSMEM_END definition Date: Thu, 24 Sep 2026 17:32:59 +0200 Message-ID: <2026092455-CVE-2026-93237-6abf@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3213; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=qylOPSdgSRj9rZIvbrK5BjTB7a+XTfs0AU3bX5wITNI=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlbnZazHzzi8unpir8P50Q8tErkatgxXZzNhKnx1OmA5 d8F+Xcwd8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBE/jIxzA9QPLn2jOfCtB/V X++5njJbfC4/O5lhDr9lTJD1jK/6OkurXyXyr4o1u6k1CQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add DIRECT_MAP_PHYSMEM_END definition get_free_mem_region() and mhp_get_pluggable_range() bound their search to DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback in include/linux/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is (1ULL << MAX_PHYSMEM_BITS) - 1, a compile-time constant that does not adapt to the CPU's physical address space bits (cpu_pabits, probed from CPUCFG1). The vmemmap window only covers physical space below 2^(cpu_pabits+1) (i.e. VMEMMAP_SIZE), so on CPUs with fewer physical address bits than MAX_PHYSMEM_BITS the fallback allows get_free_mem_region() to return a ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then wraps the memmap range around and maps it into low memory, silently corrupting the page tables. The same search also picked the top-of- address-space region that crashed memmap_init_zone_device() with amdkfd on Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 ("LoongArch/mm: align vmemmap to maximal folio size") keeps that region in bounds on current Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g. the Loongson-2K series) are still affected. Define DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical range, (1ULL << (cpu_pabits + 1)) - 1, capped at (1ULL << MAX_PHYSMEM_BITS) - 1 under CONFIG_SPARSEMEM, similar to the commit f3336b48cf9d ("riscv: mm: Define DIRECT_MAP_PHYSMEM_END"). [1] https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/ The Linux kernel CVE team has assigned CVE-2026-93237 to this issue. Affected and fixed versions =========================== Fixed in 6.18.51 with commit ab275a23b4d9f04ca6c2f5f6a3246194e045a761 Fixed in 7.2.5 with commit 55e18311c705cceef6c34d522ea387b1f0069bab Fixed in 7.3-rc1 with commit 2677f97a67fdbc62a82ce1faa67791f54451d36f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-93237 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/loongarch/include/asm/pgtable.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ab275a23b4d9f04ca6c2f5f6a3246194e045a761 https://git.kernel.org/stable/c/55e18311c705cceef6c34d522ea387b1f0069bab https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f