Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89756— mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.12.109之前版本、6.18.50之前版本和7.2.4之前版本存在安全漏洞，该漏洞源于migrate_pages_batch()未报告Tasks-RCU静默状态，在KVM主机上批量解除映射时开销较大，导致迁移任务阻塞Tasks-RCU宽限期数分钟。

AI Predicted 7.0 Difficulty: Hard EPSS 0.19% · P8

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 8315f42295d2667a7f942f154b73a86fd7cb2227< 8c6d63d434ebb85c6cf3dac1e70a171b183c6614 affected
8315f42295d2667a7f942f154b73a86fd7cb2227< 4757542649af56d894e25e30f57cd497dffad53f affected
8315f42295d2667a7f942f154b73a86fd7cb2227< 4996a7bc01ef35570664854dac2530c604981039 affected
8315f42295d2667a7f942f154b73a86fd7cb2227< 5dc0daff0341c6baba19c38f47d299ac831d7e99 affected
8315f42295d2667a7f942f154b73a86fd7cb2227< 66734981b4d3c105223a13c827c9c73be18d91ad affected
8315f42295d2667a7f942f154b73a86fd7cb2227< efe8f86c0916f0f74eea74ae21a3b37f728c6bad affected
3.18 affected
< 3.18 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89756

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batch() unmaps each folio before moving it, and every unmap runs the mmu_notifier invalidate callbacks. On KVM hosts try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time. The loop already calls cond_resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state. A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet: INFO: rcu_tasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdp_mmu_zap_leafs tdp_mmu_next_root gfn_to_pfn_cache_invalidate_start kvm_mmu_notifier_invalidate_range_start __mmu_notifier_invalidate_range_start try_to_migrate_one try_to_migrate migrate_pages_batch migrate_pages compact_zone compact_node kcompactd kthread Use cond_resched_tasks_rcu_qs() so a quiescent state is reported even when cond_resched() does nothing. This has also been discussed at [1]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.12.109之前版本、6.18.50之前版本和7.2.4之前版本存在安全漏洞，该漏洞源于migrate_pages_batch()未报告Tasks-RCU静默状态，在KVM主机上批量解除映射时开销较大，导致迁移任务阻塞Tasks-RCU宽限期数分钟。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8315f42295d2667a7f942f154b73a86fd7cb2227 ~ 8c6d63d434ebb85c6cf3dac1e70a171b183c6614 -
Linux Linux 3.18 -

II. Public POCs for CVE-2026-89756

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89756

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89756 (6)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89536 9.8 CRITICAL SUNRPC: wait for in-flight client TLS handshake callback
CVE-2026-89533 9.8 CRITICAL svcrdma: Fix offset arithmetic in read_chunk_range
CVE-2026-81002 9.8 CRITICAL xdp: fix zero-copy frame layout
CVE-2026-89643 9.8 CRITICAL audit: avoid dropping live tree ref on fsnotify rule autoremove
CVE-2026-89526 9.8 CRITICAL svcrdma: Validate Read chunk positions before reconstruction
CVE-2026-89652 9.8 CRITICAL ceph: bound copied dentry name length in NFS export get_name
CVE-2026-89651 9.8 CRITICAL ceph: bound MDSCapAuth path and fs_name decode in handle_session()
CVE-2026-89653 9.8 CRITICAL ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
CVE-2026-89654 9.8 CRITICAL ceph: fix UAF in check_new_map() on session freed during unlock
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89712 9.8 CRITICAL NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89689 9.8 CRITICAL nfsd: don't free session slots that are still in use
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89756

No comments yet

Leave a comment