Executive brief
A race condition was identified in the Linux kernel's memory management system during the process of moving data between physical memory locations. This flaw could lead to internal system errors or kernel warnings when the system attempts to manage large memory pages. While primarily a stability issue, such flaws can occasionally be leveraged to cause system crashes or unpredictable behavior in multi-user environments.
Technical details
A race condition exists in migrate_folio_move() within the Linux kernel's memory management (mm) subsystem. The function originally replayed the deferred split queue state for a destination folio after calling remove_migration_ptes(), which made the folio visible to other processes before it was properly requeued. This timing allowed concurrent rmap-removal paths to mark the folio as partially mapped, triggering a WARN in deferred_split_folio(). The fix moves the requeue operation before remove_migration_ptes() and updates deferred_split_scan() to handle cases where folio_trylock() fails during migration, preventing folios from being silently lost from the split queue.
Affected products
- Linux Linux Kernel All versions prior to the fix in May 2026
Timeline
- 2026-04-01: other: Initial patch authored
- 2026-05-27: disclosed: CVE published
- 2026-05-27: patched: Fix merged into stable trees