GHSA-3M6W-WH62-J86P
Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-14 15:32In the Linux kernel, the following vulnerability has been resolved:
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
migrate_pages_batch() unmaps each folio before moving it, and every unmap runs the mmu_notifier invalidate callbacks. On KVM hosts try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time.
The loop already calls cond_resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state.
A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet:
INFO: rcu_tasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdp_mmu_zap_leafs tdp_mmu_next_root gfn_to_pfn_cache_invalidate_start kvm_mmu_notifier_invalidate_range_start __mmu_notifier_invalidate_range_start try_to_migrate_one try_to_migrate migrate_pages_batch migrate_pages compact_zone compact_node kcompactd kthread
Use cond_resched_tasks_rcu_qs() so a quiescent state is reported even when cond_resched() does nothing.
This has also been discussed at [1]
{
"affected": [],
"aliases": [
"CVE-2026-89756"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T20:20:06Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()\n\nmigrate_pages_batch() unmaps each folio before moving it, and every\nunmap runs the mmu_notifier invalidate callbacks. On KVM hosts\ntry_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -\u003e\ntdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps\nthe CPU busy for a long time.\n\nThe loop already calls cond_resched(), but on PREEMPTION kernels that is\na no-op, and involuntary preemption is not a Tasks-RCU quiescent state.\n\nA long batch therefore never reports a quiescent state, and the\nmigrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the\nTasks-RCU grace period for minutes, which is common at Meta fleet:\n\n INFO: rcu_tasks detected stalls on tasks:\n 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task\n Call Trace:\n tdp_mmu_zap_leafs\n tdp_mmu_next_root\n gfn_to_pfn_cache_invalidate_start\n kvm_mmu_notifier_invalidate_range_start\n __mmu_notifier_invalidate_range_start\n try_to_migrate_one\n try_to_migrate\n migrate_pages_batch\n migrate_pages\n compact_zone\n compact_node\n kcompactd\n kthread\n\nUse cond_resched_tasks_rcu_qs() so a quiescent state is reported even\nwhen cond_resched() does nothing.\n\nThis has also been discussed at [1]",
"id": "GHSA-3m6w-wh62-j86p",
"modified": "2026-09-14T15:32:36Z",
"published": "2026-09-11T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89756"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4757542649af56d894e25e30f57cd497dffad53f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4996a7bc01ef35570664854dac2530c604981039"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5dc0daff0341c6baba19c38f47d299ac831d7e99"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/66734981b4d3c105223a13c827c9c73be18d91ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c6d63d434ebb85c6cf3dac1e70a171b183c6614"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/efe8f86c0916f0f74eea74ae21a3b37f728c6bad"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.