Review reviewHigh

CVE-2026-46277

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().

CVSS: 7.8
EPSS: 0.12%
CISA KEV: Not listed
Published: 2026.06.09

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.12%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= d245f9b4ab806733a77e51a218ca7b8bc3135cd9 < 85be0a262e39c706edb53c88af8afde2e98222ba, >= d245f9b4ab806733a77e51a218ca7b8bc3135cd9 < 39928984956037cabd304321cb8f342e47421db5, >= 6.19, >= 6.19 < 7.0.4
Fixed versions: 7.0.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available