{"id":28501,"date":"2026-09-25T00:31:33","date_gmt":"2026-09-24T16:31:33","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93237"},"modified":"2026-09-25T00:31:33","modified_gmt":"2026-09-24T16:31:33","slug":"cve-2026-93237","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93237","title":{"rendered":"CVE-2026-93237 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Add DIRECT"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>LoongArch: Add DIRECT_MAP_PHYSMEM_END definition<\/p>\n<p>get_free_mem_region() and mhp_get_pluggable_range() bound their search<br \/>\nto DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback<br \/>\nin include\/linux\/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is<br \/>\n(1ULL &lt;&lt; MAX_PHYSMEM_BITS) &#8211; 1, a compile-time constant that does not<br \/>\nadapt to the CPU&#039;s physical address space bits (cpu_pabits, probed from<br \/>\nCPUCFG1).<\/p>\n<p>The vmemmap window only covers physical space below 2^(cpu_pabits+1)<br \/>\n(i.e. VMEMMAP_SIZE), so on CPUs with fewer physical address bits than<br \/>\nMAX_PHYSMEM_BITS the fallback allows get_free_mem_region() to return<br \/>\na ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then<br \/>\nwraps the memmap range around and maps it into low memory, silently<br \/>\ncorrupting the page tables. The same search also picked the top-of-<br \/>\naddress-space region that crashed memmap_init_zone_device() with amdkfd<br \/>\non Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 (&quot;LoongArch\/mm:<br \/>\nalign vmemmap to maximal folio size&quot;) keeps that region in bounds on<br \/>\ncurrent Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g.<br \/>\nthe Loongson-2K series) are still affected.<\/p>\n<p>Define DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical range,<br \/>\n(1ULL &lt;&lt; (cpu_pabits + 1)) &#8211; 1, capped at (1ULL &lt;&lt; MAX_PHYSMEM_BITS) &#8211; 1<br \/>\nunder CONFIG_SPARSEMEM, similar to the commit f3336b48cf9d (&quot;riscv: mm:<br \/>\nDefine DIRECT_MAP_PHYSMEM_END&quot;).<\/p>\n<p>[1] https:\/\/lore.kernel.org\/amd-gfx\/20250814032153.227285-1-jeffbai@aosc.io\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>LoongArch: Add DIRECT_MAP_PHYSMEM_END definition<\/p>\n<p>get_free_mem_region() and mhp_get_pluggable_range() bound their search<br \/>\nto DIRECT_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28501","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}