CVE-2026-93218

Description

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd madvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then madvise_free_huge_pmd() takes pmd_trans_huge_lock(). pmd_is_huge() returns true for a device-private PMD, so orig_pmd can be device-private and enter the !pmd_present() branch. Skip device-private PMDs in that non-present branch and continue to out before calling pmd_folio(). Downgrade the check to VM_WARN_ON_ONCE() so an unexpected PMD softleaf logs a warning rather than panicking. Drop the thp_migration_supported() guard: it expands to IS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both pmd_is_migration_entry() and pmd_is_device_private_entry() already return false when that config is not selected, so the guard suppresses only the case where the warning would already be silent. Potential trigger: an HMM-based GPU driver races with madvise(MADV_FREE): migrate_vma_pages() flips the PMD to a device-private entry between the caller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock().

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: —
CVSS score: —
CVSS vector: —
Effective score: no score available from CNA, NVD, or AI yet
CWE(s): —
Reserved: 2026-09-17
Published: 2026-09-24 15:10 UTC
Last updated: 2026-09-24 15:10 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93218.json

AI-forensic CVSS estimate

Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.

No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85947
Assigner: Linux
Published: Sep 24, 2026, 3:10:41 PM
Updated: Sep 24, 2026, 3:10:41 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0000
Vendors: Linux
Products: Linux (368076f52ebeecd33e10a9f80905d7508b6b6149 <5e3026bf736498115884d6c7bd0308ba29e0474c)

Linux (368076f52ebeecd33e10a9f80905d7508b6b6149 <ce579dcf730ce5ed8043a5eeea18a3e6706a97e5)

Linux (patch: 0)

Linux (6.19)

Linux (patch: 7.3-rc1)

Linux (patch: 7.2.4)
Aliases: GHSA-xw3m-6qvq-wwvg

ENISA description: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd madvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then madvise_free_huge_pmd() takes pmd_trans_huge_lock(). pmd_is_huge() returns true for a device-private PMD, so orig_pmd can be device-private and enter the !pmd_present() branch. Skip device-private PMDs in that non-present branch and continue to out before calling pmd_folio(). Downgrade the check to VM_WARN_ON_ONCE() so an unexpected PMD softleaf logs a warning rather than panicking. Drop the thp_migration_supported() guard: it expands to IS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both pmd_is_migration_entry() and pmd_is_device_private_entry() already return false when that config is not selected, so the guard suppresses only the case where the warning would already be silent. Potential trigger: an HMM-based GPU driver races with madvise(MADV_FREE): migrate_vma_pages() flips the PMD to a device-private entry between the caller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock().

EUVD references (2)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`368076f52ebeecd33e10a9f80905d7508b6b6149` (affected), `368076f52ebeecd33e10a9f80905d7508b6b6149` (affected)	—
Linux	Linux	`6.19` (affected), `0` (unaffected), `7.2.4` (unaffected), `7.3-rc1` (unaffected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Microsoft Security Advisory CVE-2026-21218 - GitHub

web:github.com

Microsoft Security Advisory CVE - 2026 -21218 | .NET Security Feature Bypass Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this ...

2026-09-25 10:45 UTC
Guidance for mitigating silicon based micro-architectural and ...

web:learn.microsoft.com

Learn more about Guidance for mitigating silicon based micro-architectural and speculative execution side-channel vulnerabilities in Azure.

2026-09-25 10:45 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

2026-09-25 10:45 UTC
Security Update Guide - Microsoft

web:msrc-ppe.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-25 10:45 UTC
N-central 2026.3 Hotfix 4 - CVE-2026-86218 | N-able Status

web:status.n-able.com

Build Number: 2026.3.1.14 Last Updated: Sept 5th 2026 Security Update This hotfix includes security fixes for CVE - 2026 -86218 which is a critical-CVSS-rated vulnerability that could allow for pre-authenticated remote code execution on the N-central server This vulnerability was responsibly disclosed by a third party through our security disclosure program. At this time, we have no confirmations ...

2026-09-25 10:45 UTC
July 18, 2026—Hotpatch KB5121768 (OS Builds 26200.8893 and 26100.8893 ...

web:support.microsoft.com

This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...

2026-09-25 10:45 UTC
N-central CVE-2026-86218: CVSS 10.0 RCE Patched [2026]

web:tech-insider.org

A Fourth Emergency Hotfix in Five Weeks Inside CVE - 2026 -86206 and CVE - 2026 -86207: The Authentication Bypass Chain CVE - 2026 -86218: The CVSS 10.0 Pre-Auth RCE Timeline: How the N-central Crisis Unfolded The Three N-central CVEs at a Glance Why N-central Is a Bigger Target Than a Typical SaaS Bug N-able's Response vs. Independent Researcher Findings Echoes of Kaseya 2021: Is This a Supply-Chain ...

2026-09-25 10:45 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of updates for which you want to be notified: Major ...

2026-09-25 10:45 UTC
Critical N-able N-central Zero-Day (CVE-2026-86218) Actively Exploited ...

web:www.rescana.com

Hosted (NCOD) instances have already been patched by N-able. Workaround and Mitigation Immediate action is required to mitigate the risk posed by these vulnerabilities. Organizations should apply Hotfix 4 (2026.3.1.14) to all on-premises N-central deployments without delay.

2026-09-25 10:45 UTC
CVE-2026-86218 Impact, Exploitability, and Mitigation Steps | Wiz

web:www.wiz.io

Understand the critical aspects of CVE - 2026 -86218 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

2026-09-25 10:45 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-93218.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e3026bf736498115884d6c7bd0308ba29e0474c",
              "status": "affected",
              "version": "368076f52ebeecd33e10a9f80905d7508b6b6149",
              "versionType": "git"
            },
            {
              "lessThan": "ce579dcf730ce5ed8043a5eeea18a3e6706a97e5",
              "status": "affected",
              "version": "368076f52ebeecd33e10a9f80905d7508b6b6149",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd\n\nmadvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then\nmadvise_free_huge_pmd() takes pmd_trans_huge_lock().  pmd_is_huge()\nreturns true for a device-private PMD, so orig_pmd can be device-private\nand enter the !pmd_present() branch.\n\nSkip device-private PMDs in that non-present branch and continue to out\nbefore calling pmd_folio().  Downgrade the check to VM_WARN_ON_ONCE() so\nan unexpected PMD softleaf logs a warning rather than panicking.  Drop the\nthp_migration_supported() guard: it expands to\nIS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both\npmd_is_migration_entry() and pmd_is_device_private_entry() already return\nfalse when that config is not selected, so the guard suppresses only the\ncase where the warning would already be silent.\n\nPotential trigger: an HMM-based GPU driver races with madvise(MADV_FREE):\nmigrate_vma_pages() flips the PMD to a device-private entry between the\ncaller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:10:41.370Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e3026bf736498115884d6c7bd0308ba29e0474c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce579dcf730ce5ed8043a5eeea18a3e6706a97e5"
        }
      ],
      "title": "mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93218",
    "datePublished": "2026-09-24T15:10:41.370Z",
    "dateReserved": "2026-09-17T16:02:15.094Z",
    "dateUpdated": "2026-09-24T15:10:41.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}