CVE-2026-46277: mm/zone_device: do not touch device folio after calling ->folio_free()

Synopsis

A use-after-free vulnerability exists in the Linux kernel's mm/zone_device memory management subsystem. An attacker with a local shell on the host can trigger the flaw without any user interaction, exploiting a window where a device folio is accessed after it has already been freed and potentially reallocated by a driver. Successful exploitation gives the attacker full read, write, and crash capability over the affected system. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the vulnerable service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; no administrative credentials are needed.

• Victim interactionNot required

  No victim action is required; the attacker can trigger the use-after-free entirely through their own process activity.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race conditions or specific memory layout dependencies are specified by the CVSS vector.

Blast Radius

• Reads arbitrary kernel memory, exposing secrets such as credentials, cryptographic keys, and session tokens held in kernel space.
• Writes to arbitrary kernel memory, allowing modification of security policies, process credentials, or persisted data structures.
• Crashes the affected host entirely, disrupting all workloads running on the node.
• Achieves kernel-level code execution, bypassing container isolation boundaries and potentially escaping to the underlying host.