Executive brief
A vulnerability in the Linux kernel's memory management system can lead to a system hang or 'livelock.' This occurs when the system gets stuck in an infinite loop while trying to move data between different types of memory, such as system RAM and specialized device memory. If exploited, a local user could cause the system to become unresponsive, resulting in a total denial of service.
Technical details
A livelock/starvation vulnerability exists in the Linux kernel's memory management (mm) subsystem, specifically within the hmm_range_fault() function. The issue arises when hmm_range_fault() fails a folio_trylock() in do_swap_page while attempting to migrate a device-private folio to system RAM. If the process holding the lock is waiting for a work item scheduled on the same CPU, the spinning hmm_range_fault() starves that work item, preventing the lock from ever being released. This is particularly prevalent in environments with no or voluntary-only preemption. The fix involves modifying do_swap_page() to wait for the folio to be unlocked rather than spinning indefinitely.
Affected products
- Linux Linux Kernel 6.15 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-02-10: patched: Initial patch proposed by Thomas Hellström
- 2026-05-08: advisory: CVE-2026-43404 published