---
id: CVE-2026-80686
title: 'mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

  pte_pfn() and pte_dirty() have undefined behaviour when called on a
  non-present PTE. In migrate_vma…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a <
    26f9ca8ed42cba25d2c75daff13561cce6019395
  - >-
    Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a <
    5b948706f11a950bc73c5304630d0a7eafc40daf
  - >-
    Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a <
    86d55447de3738620b9a8272ff167ce97e7f7203
  - >-
    Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a <
    2be94d6b20789b8865b1864dae5fe458ca85e019
  - >-
    Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a <
    42f30fa5481a1f90571ccdfbb20d2e25e47ae76e
  - >-
    Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a <
    63867c82d0c0c2d182016a32b1cc0103116b0ea5
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:02:42.819788Z'
published: '2026-08-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:52.947Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80686'
references:
  - url: 'https://git.kernel.org/stable/c/26f9ca8ed42cba25d2c75daff13561cce6019395'
  - url: 'https://git.kernel.org/stable/c/5b948706f11a950bc73c5304630d0a7eafc40daf'
  - url: 'https://git.kernel.org/stable/c/86d55447de3738620b9a8272ff167ce97e7f7203'
  - url: 'https://git.kernel.org/stable/c/2be94d6b20789b8865b1864dae5fe458ca85e019'
  - url: 'https://git.kernel.org/stable/c/42f30fa5481a1f90571ccdfbb20d2e25e47ae76e'
  - url: 'https://git.kernel.org/stable/c/63867c82d0c0c2d182016a32b1cc0103116b0ea5'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06694
ingestedAt: '2026-11-06T18:00:12.537Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

pte_pfn() and pte_dirty() have undefined behaviour when called on a
non-present PTE. In migrate_vma_collect_pmd(), these functions may be
invoked on non-present entries (e.g., device-private entries), leading
to potential crashes from pte_pfn() or incorrect dirty folio accounting
from pte_dirty(). Fix both by guarding with pte_present() checks.

## Affected

- `Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a < 26f9ca8ed42cba25d2c75daff13561cce6019395`
- `Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a < 5b948706f11a950bc73c5304630d0a7eafc40daf`
- `Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a < 86d55447de3738620b9a8272ff167ce97e7f7203`
- `Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a < 2be94d6b20789b8865b1864dae5fe458ca85e019`
- `Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a < 42f30fa5481a1f90571ccdfbb20d2e25e47ae76e`
- `Linux >= 6c287605fd56466e645693eff3ae7c08fba56e0a < 63867c82d0c0c2d182016a32b1cc0103116b0ea5`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.