CVE-2026-90391 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone dmirror_fault() is called from the dmirror_read() and dmirror_write() retry loops after dmirror_do_read() or dmirror_do_write() finds a missing device page table entry. If the mirrored mm has already exited, mmget_not_zero() fails. The current code returns 0 in that case, which tells the caller that faulting succeeded even though no page was faulted and no device page table entry was installed. The caller then retries the same address, hits -ENOENT again, and can loop forever without making progress. Return -EFAULT instead, so the ioctl fails when the mirrored mm is no longer faultable.
AZL-102867
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:AZL-102867
kernel
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.6.157.1-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.157.1-1"
}
]
}
],
"package": {
"name": "kernel",
"purl": "pkg:rpm/azure-linux/kernel",
"ecosystem": "Azure Linux:3"
},
"database_specific": {
"source": "https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102867.json"
}
}
]- Related CVEs
- CVE-2026-90391
Source reference:
/upstream
Publisher severity
No explicit severity was provided.
- Event
- #68492 · Revision 1
- Added to Heist Feed
- Publisher date