Bug 2502374 (CVE-2026-63953)

Summary:	CVE-2026-63953 kernel: mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's memory management component, specifically within the `mm/migrate_device` module. When handling device page migration, a page table (pgtable) allocated during the `migrate_vma_insert_huge_pmd_page` function may not be properly freed if a specific error condition occurs. This oversight can lead to a memory leak, potentially impacting system stability and performance over time.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:04:38 UTC

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due
to a PMD check failure, the pgtable allocated earlier via
pte_alloc_one() is never freed, causing a memory leak.

Added free_abort label to release the pgtable in error path.

Comment 1 Keith Grant 2026-07-21 22:21:19 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071955-CVE-2026-63953-4f91@gregkh/T