---
id: CVE-2026-45880
title: 'PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails

  When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap()
  doesn't invoke percpu_ref_put…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 <
    baa42b756d183a59572f3890981a3d32b8d05d40
  - >-
    Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 <
    51b7181cfbedf289ce794b6d97a1c596c309ec38
  - >-
    Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 <
    e19cce88ec4c4877f4ff2469099b9cf23cc3e93e
  - >-
    Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 <
    a1f4dc72efc3204db95d052058d785cad7ce755f
  - >-
    Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 <
    6220694c52a5a04102b48109e4f24e958b559bd3
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:43:27.538093Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:53:10.517Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45880'
references:
  - url: 'https://git.kernel.org/stable/c/baa42b756d183a59572f3890981a3d32b8d05d40'
  - url: 'https://git.kernel.org/stable/c/51b7181cfbedf289ce794b6d97a1c596c309ec38'
  - url: 'https://git.kernel.org/stable/c/e19cce88ec4c4877f4ff2469099b9cf23cc3e93e'
  - url: 'https://git.kernel.org/stable/c/a1f4dc72efc3204db95d052058d785cad7ce755f'
  - url: 'https://git.kernel.org/stable/c/6220694c52a5a04102b48109e4f24e958b559bd3'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05181
ingestedAt: '2026-11-06T16:57:43.392Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails

When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap()
doesn't invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired
after gen_pool_alloc_owner(), and memunmap_pages() will hang forever when
trying to remove the PCI device.

Fix it by adding the missed percpu_ref_put().

## Affected

- `Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 < baa42b756d183a59572f3890981a3d32b8d05d40`
- `Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 < 51b7181cfbedf289ce794b6d97a1c596c309ec38`
- `Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 < e19cce88ec4c4877f4ff2469099b9cf23cc3e93e`
- `Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 < a1f4dc72efc3204db95d052058d785cad7ce755f`
- `Linux >= 7e9c7ef83d785236f5a8c3761dd053fae9b92fb8 < 6220694c52a5a04102b48109e4f24e958b559bd3`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.