---
id: CVE-2026-90391
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

  dmirror_fault() is called from the dmirror_read() and dmirror_write()
  retry loops after dmirror_do_read…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

  dmirror_fault() is called from the dmirror_read() and dmirror_write()
  retry loops after dmirror_do_read…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    50606ced303782f8715e2d0b98ca374ea498fa29
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    541a67f21ab807c8dbc0ea88d5a2eb73b2618090
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    d8e64ffab01e032ae29159d27230ace8cf8bdc80
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    2636569ea7c19d9a40db4a1e8d0a027bdacf1569
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    701347e31aa607f3782403151a3125729d685275
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    a2074f86fc9653831e4fb7b711bb715db330f182
  - >-
    Linux >= b2ef9f5a5cb37643ca5def3516c546457074b882 <
    6a8024511ddf4877435c34fb3d6028aa8e590649
  - Linux 5.8
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:38.653'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90391'
references:
  - url: 'https://git.kernel.org/stable/c/2636569ea7c19d9a40db4a1e8d0a027bdacf1569'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/50606ced303782f8715e2d0b98ca374ea498fa29'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/541a67f21ab807c8dbc0ea88d5a2eb73b2618090'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6a8024511ddf4877435c34fb3d6028aa8e590649'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/701347e31aa607f3782403151a3125729d685275'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a2074f86fc9653831e4fb7b711bb715db330f182'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d8e64ffab01e032ae29159d27230ace8cf8bdc80'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90391.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90391'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536535'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90391'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90391'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90391.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.803Z'
epss: 0.00211
epssPercentile: 0.1121
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-835
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

dmirror_fault() is called from the dmirror_read() and dmirror_write()
retry loops after dmirror_do_read() or dmirror_do_write() finds a missing
device page table entry.

If the mirrored mm has already exited, mmget_not_zero() fails.  The
current code returns 0 in that case, which tells the caller that faulting
succeeded even though no page was faulted and no device page table entry
was installed.  The caller then retries the same address, hits -ENOENT
again, and can loop forever without making progress.

Return -EFAULT instead, so the ioctl fails when the mirrored mm is no
longer faultable.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90391.json)