{"id":"CVE-2026-90391","revision":"eedd33993a3e48b19ca3cc18f871472e","records":[{"revision":"eedd33993a3e48b19ca3cc18f871472e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90391","aliases":[],"title":"lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm: fail dmirror_fault() when the mirrored mm is gone\n\ndmirror_fault() is called from the dmirror_read() and dmirror_write()\nretry loops after dmirror_do_read() or dmirror_do_write() finds a missing\ndevice page table entry.\n\nIf the mirrored mm has already exited, mmget_not_zero() fails.  The\ncurrent code returns 0 in that case, which tells the caller that faulting\nsucceeded even though no page was faulted and no device page table entry\nwas installed.  The caller then retries the same address, hits -ENOENT\nagain, and can loop forever without making progress.\n\nReturn -EFAULT instead, so the ioctl fails when the mirrored mm is no\nlonger faultable.","state":0,"publishedAt":"2026-09-17T16:09:25.083+00:00","modifiedAt":"2026-10-19T09:02:55.602+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"lib/test_hmm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"50606ced303782f8715e2d0b98ca374ea498fa29\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"541a67f21ab807c8dbc0ea88d5a2eb73b2618090\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"d8e64ffab01e032ae29159d27230ace8cf8bdc80\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"2636569ea7c19d9a40db4a1e8d0a027bdacf1569\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"701347e31aa607f3782403151a3125729d685275\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"a2074f86fc9653831e4fb7b711bb715db330f182\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b2ef9f5a5cb37643ca5def3516c546457074b882\",\n                            \"lessThan\": \"6a8024511ddf4877435c34fb3d6028aa8e590649\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"lib/test_hmm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/50606ced303782f8715e2d0b98ca374ea498fa29","https://git.kernel.org/stable/c/541a67f21ab807c8dbc0ea88d5a2eb73b2618090","https://git.kernel.org/stable/c/d8e64ffab01e032ae29159d27230ace8cf8bdc80","https://git.kernel.org/stable/c/2636569ea7c19d9a40db4a1e8d0a027bdacf1569","https://git.kernel.org/stable/c/701347e31aa607f3782403151a3125729d685275","https://git.kernel.org/stable/c/af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655","https://git.kernel.org/stable/c/a2074f86fc9653831e4fb7b711bb715db330f182","https://git.kernel.org/stable/c/6a8024511ddf4877435c34fb3d6028aa8e590649"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90391","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90391","identifiers":["CVE-2026-90391"]},"retained":false,"historicalAffected":[]}],"coverage":[]}