{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-90391",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-90391"
  ],
  "published": "2026-09-17T16:10:40Z",
  "summary": "lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm: fail dmirror_fault() when the mirrored mm is gone\n\ndmirror_fault() is called from the dmirror_read() and dmirror_write()\nretry loops after dmirror_do_read() or dmirror_do_write() finds a missing\ndevice page table entry.\n\nIf the mirrored mm has already exited, mmget_not_zero() fails.  The\ncurrent code returns 0 in that case, which tells the caller that faulting\nsucceeded even though no page was faulted and no device page table entry\nwas installed.  The caller then retries the same address, hits -ENOENT\nagain, and can loop forever without making progress.\n\nReturn -EFAULT instead, so the ioctl fails when the mirrored mm is no\nlonger faultable.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90391"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/50606ced303782f8715e2d0b98ca374ea498fa29"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/541a67f21ab807c8dbc0ea88d5a2eb73b2618090"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d8e64ffab01e032ae29159d27230ace8cf8bdc80"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2636569ea7c19d9a40db4a1e8d0a027bdacf1569"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/701347e31aa607f3782403151a3125729d685275"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a2074f86fc9653831e4fb7b711bb715db330f182"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6a8024511ddf4877435c34fb3d6028aa8e590649"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-17T16:10:40Z"
  }
}