Recommended action

Update Linux/Linux to 85be0a262e39c706edb53c88af8afde2e98222ba if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

mm/zone_device: do not touch device folio after calling ->folio_free() affects Linux/Linux (generic), Linux/Linux (generic). Severity is high. In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().

AI coding agents often install or upgrade packages automatically in generic. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update Linux/Linux to 85be0a262e39c706edb53c88af8afde2e98222ba if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

mm/zone_device: do not touch device folio after calling ->folio_free() affects Linux/Linux (generic), Linux/Linux (generic). Severity is high. In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many().

AI coding agents often install or upgrade packages automatically in generic. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software