{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "b2ef9f5a5cb37643ca5def3516c546457074b882"
            },
            {
              "fixed": "50606ced303782f8715e2d0b98ca374ea498fa29"
            },
            {
              "fixed": "541a67f21ab807c8dbc0ea88d5a2eb73b2618090"
            },
            {
              "fixed": "d8e64ffab01e032ae29159d27230ace8cf8bdc80"
            },
            {
              "fixed": "2636569ea7c19d9a40db4a1e8d0a027bdacf1569"
            },
            {
              "fixed": "701347e31aa607f3782403151a3125729d685275"
            },
            {
              "fixed": "af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655"
            },
            {
              "fixed": "a2074f86fc9653831e4fb7b711bb715db330f182"
            },
            {
              "fixed": "6a8024511ddf4877435c34fb3d6028aa8e590649"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.8.0"
            },
            {
              "fixed": "5.10.270"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.221"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.110"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90391.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm: fail dmirror_fault() when the mirrored mm is gone\n\ndmirror_fault() is called from the dmirror_read() and dmirror_write()\nretry loops after dmirror_do_read() or dmirror_do_write() finds a missing\ndevice page table entry.\n\nIf the mirrored mm has already exited, mmget_not_zero() fails.  The\ncurrent code returns 0 in that case, which tells the caller that faulting\nsucceeded even though no page was faulted and no device page table entry\nwas installed.  The caller then retries the same address, hits -ENOENT\nagain, and can loop forever without making progress.\n\nReturn -EFAULT instead, so the ioctl fails when the mirrored mm is no\nlonger faultable.",
  "id": "CVE-2026-90391",
  "modified": "2026-09-19T03:30:30.739018556Z",
  "published": "2026-09-17T16:09:25.083Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2636569ea7c19d9a40db4a1e8d0a027bdacf1569"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/50606ced303782f8715e2d0b98ca374ea498fa29"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/541a67f21ab807c8dbc0ea88d5a2eb73b2618090"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a8024511ddf4877435c34fb3d6028aa8e590649"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/701347e31aa607f3782403151a3125729d685275"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a2074f86fc9653831e4fb7b711bb715db330f182"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af7a6d6ec36a16a583ba2e4e9984c3cf1fe34655"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d8e64ffab01e032ae29159d27230ace8cf8bdc80"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90391.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90391"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone"
}