CVE-2026-46280

Description

In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages. Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration.

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.1 / 10

CVSS vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Effective score

7.1 / 10 HIGH source: CNA overview

MSRC score

5.5 / 10 MEDIUM MS rating: Moderate

CWE(s)

—

Reserved

—

Published

2026-06-09 07:00 UTC

Last updated

2026-06-20 01:43 UTC

Source

https://www.tenable.com/cve/CVE-2026-46280

Linked Threat

CVE-2026-46280 — CVE-2026-46280

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-08 17:16:45 UTC

NVD last modified

2026-07-23 08:10:00 UTC

NVD CVSS v3.1

7.8 / 10 HIGH source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

1.8 / 10

Impact subscore

5.9 / 10

EPSS score

0.0013 (probability of exploitation in next 30 days)

EPSS percentile

2.64% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01

NVD-assigned CWE(s): CWE-416 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-35145

Assigner

Linux

Published

Jun 8, 2026, 3:41:23 PM

Updated

Jun 19, 2026, 12:00:04 PM

EUVD base score (CVSS 3.1)

7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.1300

Vendors

Linux

Products

Linux (b2ef9f5a5cb37643ca5def3516c546457074b882 <9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1)

Linux (patch: 6.12.86)

Linux (patch: 6.1.176)

Linux (b2ef9f5a5cb37643ca5def3516c546457074b882 <234071b4318feaeb27cd2e4e1b16ef6b055adf89)

Linux (patch: 7.1)

Linux (patch: 6.6.140)

Linux (patch: 6.18.27)

Linux (b2ef9f5a5cb37643ca5def3516c546457074b882 <38f113f81d3f0adc658a4475dd3ecaec985e21d3)

Linux (5.8)

Linux (b2ef9f5a5cb37643ca5def3516c546457074b882 <bf477abd448c76bb8ea51c9b4f63a3a17c4b6239)

Linux (patch: 7.0.4)

Linux (patch: 0)

Linux (b2ef9f5a5cb37643ca5def3516c546457074b882 <744dd97752ef1076a8d8672bb0d8aa2c7abc1144)

Linux (b2ef9f5a5cb37643ca5def3516c546457074b882 <5846715b6382dd4c6a69b35a56ca6115d33bc2a0)

Aliases

GHSA-vjjg-r28q-g2g4

ENISA description: In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages. Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration.

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-07-23 03:00 UTC (source: CVRF).

MS severity

Moderate

MS CVSS base score

5.5 / 10 (temporal 5.5)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Release

2026-Jun

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (9)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• None Available msrc
• MSRC update guide: CVE-2026-46280 msrc
• https://git.kernel.org/stable/c/744dd97752ef1076a8d8672bb0d8aa2c7abc1144 tenable:git.kernel.org
• https://git.kernel.org/stable/c/9de1eb0aac2862d6144b8db0ec1388e79f8bc3e1 tenable:git.kernel.org
• https://git.kernel.org/stable/c/bf477abd448c76bb8ea51c9b4f63a3a17c4b6239 tenable:git.kernel.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-46280 tenable:nvd.nist.gov
• https://git.kernel.org/stable/c/38f113f81d3f0adc658a4475dd3ecaec985e21d3 tenable:git.kernel.org
• https://www.cve.org/CVERecord?id=CVE-2026-46280 tenable:www.cve.org
• https://git.kernel.org/stable/c/5846715b6382dd4c6a69b35a56ca6115d33bc2a0 tenable:git.kernel.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• NVD - Home
  web:nvd.nist.gov

  The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

  2026-06-19 02:38 UTC
• The Official Fix Chocolate Bar | Dubai's Viral Chocolate Bars
  web:officialfixdessertchocolatier.com

  Indulge in Dubai's viral chocolate bars with FIX Dessert Chocolatier. Shop our hero collection featuring Baklawa, Knafeh, Biscoff, and more. Fast delivery in Dubai & Abu Dhabi. Order now!

  2026-06-19 02:38 UTC
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
  web:techcommunity.microsoft.com

  UPDATE June 9, 2026 : Please see our release blog post for June 2026 Security Update for more information on this CVE : Released: June 2026 Exchange Server Security Updates | Microsoft Community Hub. On May 14, 2026 , Microsoft disclosed CVE - 2026 -42897, a reported vulnerability affecting Exchange Outlook Web Access (OWA). An attacker could exploit this issue by sending a specially crafted email ...

  2026-06-19 02:38 UTC
• Fix Ferreterías
  web:www.fixferreterias.com

  FIX FERRETERÍAS inicia con la emisión de CFDI 4.0, si tienes una cuenta registrada es necesario que actualices tus datos fiscales: 1.-Inicia sesión 2.- Entra al apartado Mi Cuenta 3.- Dentro de Datos de Facturación da click en cambiar dirección de facturación y posteriormente en Guardar Dirección. Los datos obligatorios son: RFC

  2026-06-19 02:38 UTC
• Home - The Patch Augusta Municipal Golf Course
  web:www.golfthepatch.com

  Now open, The Patch features a redesigned 18-hole course, led by golf course architects Tom Fazio and Beau Welling, and a new 9-hole short course, The Loop at The Patch , designed by Tiger Woods and TGR Design. Welcome to Augusta's best-in-class public golf experience.

  2026-06-19 02:38 UTC
• FIX Dessert Chocolatier (@fixdessertchocolatier) - Instagram
  web:www.instagram.com

  570K Followers, 8 Following, 352 Posts - FIX Dessert Chocolatier (@fixdessertchocolatier) on Instagram: "CREATORS OF THE ORIGINAL DUBAI CHOCOLATE 📍DXB Terminal 1 + 3 🇦🇪📍Changi 🇸🇬 Online drops: 2PM & 5PM only on @careemuae We do not have a website ⚠️"

  2026-06-19 02:38 UTC
• Oracle Critical Patch Update Advisory - January 2026
  web:www.oracle.com

  Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

  2026-06-19 02:38 UTC
• Oracle Critical Security Patch Update Advisory - May 2026
  web:www.oracle.com

  This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

  2026-06-19 02:38 UTC
• Oracle's Second Monthly Security Updates Deliver 245 Patches
  web:www.securityweek.com

  Vulnerabilities Oracle's Second Monthly Security Updates Deliver 245 Patches Oracle has released its June 2026 Critical Security Patch Update to fix vulnerabilities in Communications, EBS, Enterprise Manager and other products.

  2026-06-19 02:38 UTC
• CVE-2026-46280 | Tenable®
  web:www.tenable.com

  In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops ...

  2026-06-19 02:38 UTC

Only Available for Registered Users. Sign in to view.