PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46280 Linux CVE debrief

A use-after-free vulnerability was discovered in the Linux kernel's test_hmm module. The vulnerability occurs when the dmirror_fops_release() function is called, which frees the dmirror struct without migrating device private pages back to system memory. This leaves the pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages, the dmirror_devmem_fault() callback dereferences the stale pointer, causing a kernel panic.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Linux kernel developers and users who rely on the test_hmm module.

Technical summary

The vulnerability is caused by the dmirror_fops_release() function not migrating device private pages back to system memory before freeing the dmirror struct. This can lead to a kernel panic when a subsequent fault occurs on those pages.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers to fix the vulnerability.
  • Use the latest Linux kernel version that includes the fix.

Evidence notes

The vulnerability was reported by Zenghui Yu and analyzed by Lorenzo.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46280 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46280

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46280 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46280

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/38f113f81d3f0adc658a4475dd3ecaec985e21d3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5846715b6382dd4c6a69b35a56ca6115d33bc2a0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/744dd97752ef1076a8d8672bb0d8aa2c7abc1144

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bf477abd448c76bb8ea51c9b4f63a3a17c4b6239

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.