Vulnerability-Lookup

CVE-2026-80719 (GCVE-0-2026-80719)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53

Title

mm: mglru: fix stale batch updates after memcg reparenting

Summary

In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker batches per-generation size deltas in walk->nr_pages while walking page tables without holding the lruvec lock. The reset_batch_size() later folds those deltas into walk->lruvec under the lruvec lock. The page table walker can run concurrently with the memcg reparenting path as follows: CPU0 CPU1 ==== ==== walk_mm --> walk_page_range --> update_batch_size --> walk->nr_pages += delta mem_cgroup_css_offline --> memcg_reparent_objcgs --> lock lruvec lru_gen_reparent_memcg --> reparent child folios to parent unlock lruvec lock lruvec reset_batch_size --> child lrugen->nr_pages += delta This will trigger the following warning in lru_gen_exit_memcg(): VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0, sizeof(lruvec->lrugen.nr_pages))); And the user-visible impact of underestimated nr_pages in MGLRU was premature OOMs because MGLRU does not try to reclaim memory when nr_pages reaches zero, but there are still more pages. To fix it, make reset_batch_size() check CSS_DYING under RCU before flushing the pending batch. A non-dying memcg keeps the original lruvec stable against RCU-delayed offlining; a dying memcg redirects the deltas to the first non-dying ancestor.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9…
https://git.kernel.org/stable/c/de4660898b7aa7e03…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: f304652609eae3814b0e9d11c75c0e0cb62da31f , < fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101 (git) Affected: f304652609eae3814b0e9d11c75c0e0cb62da31f , < de4660898b7aa7e03d3b120a6bfa6b26211e4e77 (git)	guessed
Linux	Linux	Affected: 7.1 Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/memcontrol.h",
            "mm/vmscan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101",
              "status": "affected",
              "version": "f304652609eae3814b0e9d11c75c0e0cb62da31f",
              "versionType": "git"
            },
            {
              "lessThan": "de4660898b7aa7e03d3b120a6bfa6b26211e4e77",
              "status": "affected",
              "version": "f304652609eae3814b0e9d11c75c0e0cb62da31f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/memcontrol.h",
            "mm/vmscan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: mglru: fix stale batch updates after memcg reparenting\n\nThe mglru page table walker batches per-generation size deltas in\nwalk-\u003enr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk-\u003elruvec under\nthe lruvec lock.\n\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\n\nCPU0                           CPU1\n====                           ====\n\nwalk_mm\n--\u003e walk_page_range\n    --\u003e update_batch_size\n        --\u003e walk-\u003enr_pages += delta\n\n                              mem_cgroup_css_offline\n                              --\u003e memcg_reparent_objcgs\n                                  --\u003e lock lruvec\n                                      lru_gen_reparent_memcg\n                                      --\u003e reparent child folios to parent\n                                      unlock lruvec\n\n    lock lruvec\n    reset_batch_size\n    --\u003e child lrugen-\u003enr_pages += delta\n\nThis will trigger the following warning in lru_gen_exit_memcg():\n\n\tVM_WARN_ON_ONCE(memchr_inv(lruvec-\u003elrugen.nr_pages, 0,\n\t\t\t\t   sizeof(lruvec-\u003elrugen.nr_pages)));\n\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\n\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch.  A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T06:53:16.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"
        },
        {
          "url": "https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77"
        }
      ],
      "title": "mm: mglru: fix stale batch updates after memcg reparenting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80719",
    "datePublished": "2026-08-28T06:53:16.087Z",
    "dateReserved": "2026-08-26T14:34:25.788Z",
    "dateUpdated": "2026-08-28T06:53:16.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80719\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:57.720\",\"lastModified\":\"2026-08-28T08:16:57.720\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: mglru: fix stale batch updates after memcg reparenting\\n\\nThe mglru page table walker batches per-generation size deltas in\\nwalk-\u003enr_pages while walking page tables without holding the lruvec lock. \\nThe reset_batch_size() later folds those deltas into walk-\u003elruvec under\\nthe lruvec lock.\\n\\nThe page table walker can run concurrently with the memcg reparenting path\\nas follows:\\n\\nCPU0                           CPU1\\n====                           ====\\n\\nwalk_mm\\n--\u003e walk_page_range\\n    --\u003e update_batch_size\\n        --\u003e walk-\u003enr_pages += delta\\n\\n                              mem_cgroup_css_offline\\n                              --\u003e memcg_reparent_objcgs\\n                                  --\u003e lock lruvec\\n                                      lru_gen_reparent_memcg\\n                                      --\u003e reparent child folios to parent\\n                                      unlock lruvec\\n\\n    lock lruvec\\n    reset_batch_size\\n    --\u003e child lrugen-\u003enr_pages += delta\\n\\nThis will trigger the following warning in lru_gen_exit_memcg():\\n\\n\\tVM_WARN_ON_ONCE(memchr_inv(lruvec-\u003elrugen.nr_pages, 0,\\n\\t\\t\\t\\t   sizeof(lruvec-\u003elrugen.nr_pages)));\\n\\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\\nreaches zero, but there are still more pages.\\n\\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\\nflushing the pending batch.  A non-dying memcg keeps the original lruvec\\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\\nto the first non-dying ancestor.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/memcontrol.h\",\"mm/vmscan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f304652609eae3814b0e9d11c75c0e0cb62da31f\",\"lessThan\":\"fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f304652609eae3814b0e9d11c75c0e0cb62da31f\",\"lessThan\":\"de4660898b7aa7e03d3b120a6bfa6b26211e4e77\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/memcontrol.h\",\"mm/vmscan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}

GHSA-5JWV-P5CJ-5P3C

Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-28 09:31

Details

In the Linux kernel, the following vulnerability has been resolved:

mm: mglru: fix stale batch updates after memcg reparenting

The mglru page table walker batches per-generation size deltas in walk->nr_pages while walking page tables without holding the lruvec lock. The reset_batch_size() later folds those deltas into walk->lruvec under the lruvec lock.

The page table walker can run concurrently with the memcg reparenting path as follows:

CPU0 CPU1 ==== ====

walk_mm --> walk_page_range --> update_batch_size --> walk->nr_pages += delta

                          mem_cgroup_css_offline
                          --> memcg_reparent_objcgs
                              --> lock lruvec
                                  lru_gen_reparent_memcg
                                  --> reparent child folios to parent
                                  unlock lruvec

lock lruvec
reset_batch_size
--> child lrugen->nr_pages += delta

This will trigger the following warning in lru_gen_exit_memcg():

VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
               sizeof(lruvec->lrugen.nr_pages)));

And the user-visible impact of underestimated nr_pages in MGLRU was premature OOMs because MGLRU does not try to reclaim memory when nr_pages reaches zero, but there are still more pages.

To fix it, make reset_batch_size() check CSS_DYING under RCU before flushing the pending batch. A non-dying memcg keeps the original lruvec stable against RCU-delayed offlining; a dying memcg redirects the deltas to the first non-dying ancestor.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80719"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T08:16:57Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: mglru: fix stale batch updates after memcg reparenting\n\nThe mglru page table walker batches per-generation size deltas in\nwalk-\u003enr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk-\u003elruvec under\nthe lruvec lock.\n\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\n\nCPU0                           CPU1\n====                           ====\n\nwalk_mm\n--\u003e walk_page_range\n    --\u003e update_batch_size\n        --\u003e walk-\u003enr_pages += delta\n\n                              mem_cgroup_css_offline\n                              --\u003e memcg_reparent_objcgs\n                                  --\u003e lock lruvec\n                                      lru_gen_reparent_memcg\n                                      --\u003e reparent child folios to parent\n                                      unlock lruvec\n\n    lock lruvec\n    reset_batch_size\n    --\u003e child lrugen-\u003enr_pages += delta\n\nThis will trigger the following warning in lru_gen_exit_memcg():\n\n\tVM_WARN_ON_ONCE(memchr_inv(lruvec-\u003elrugen.nr_pages, 0,\n\t\t\t\t   sizeof(lruvec-\u003elrugen.nr_pages)));\n\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\n\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch.  A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor.",
  "id": "GHSA-5jwv-p5cj-5p3c",
  "modified": "2026-08-28T09:31:50Z",
  "published": "2026-08-28T09:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80719"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-80719 (GCVE-0-2026-80719)

GHSA-5JWV-P5CJ-5P3C

Tags

Sightings

Nomenclature