CVE-2026-46280: lib: test_hmm: evict device pages on file close to avoid use-after-free

Synopsis

A use-after-free vulnerability exists in the Linux kernel's HMM (Heterogeneous Memory Management) test module, specifically in the dmirror device driver's file-close path. The flaw is reachable locally by a low-privileged user who can trigger a fault on device private pages after the dmirror struct has been freed, for example by triggering a coredump on a failing test process. Successful exploitation causes a kernel panic via a stale pointer dereference, and can grant the attacker full read, write, and availability impact over the host kernel. A patched-image rebuild at fix versions 6.6.140 and 6.12.86 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required to trigger the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or root credentials to reach the vulnerable file-close path.

• Victim interactionNot required

  No victim action is needed; the attacker triggers the fault independently by interacting with the HMM test device file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker causes a kernel panic by dereferencing a freed dmirror struct pointer, crashing the affected host and denying service to all workloads running on it.
• The use-after-free condition in kernel context gives the attacker the ability to read arbitrary kernel memory, exposing secrets, credentials, or other sensitive data held in kernel space at the time of the fault.
• With kernel-level write access enabled by the freed memory region, the attacker can overwrite kernel data structures to escalate privileges or modify system behavior persistently.
• Any container or process sharing the affected kernel is exposed; isolation boundaries at the container or VM level do not prevent impact once kernel code execution is achieved.