High 8.8Published Sep 24, 2026

CVE-2026-93284drm/pagemap: dma-unmap pages before handling migration errors

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page information if it is called afterward. Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() so the pages array remains valid during DMA unmapping.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f86ad0ed620cb3c91ec7d5468e93ac68d727539d before e4331c6644db85bc6ceb470bd84bcf371b6dbfa6; from f86ad0ed620cb3c91ec7d5468e93ac68d727539d before 415f5a755cec5164b149037bf294e270b78d36c6; from f86ad0ed620cb3c91ec7d5468e93ac68d727539d before 9e6372ec2a3990662ae0a67f56ac0aee19848d5b	CNA record

References

https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6
https://git.kernel.org/stable/c/415f5a755cec5164b149037bf294e270b78d36c6
https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.