Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system-wide deadlock. This occurs when the system fails to release a lock during certain memory migration tasks, effectively freezing the operating system. This would result in a total loss of availability for the affected server or workstation.
Technical details
A spinlock leak exists in mm/migrate_device.c within the migrate_vma_insert_huge_pmd_page function. When check_stable_address_space() fails after the PMD spinlock has been acquired via pmd_lock(), the code incorrectly jumps to an 'abort' label that bypasses the necessary spin_unlock() call. This results in the lock being held indefinitely, leading to a kernel deadlock. The issue was resolved by redirecting the error path to the 'unlock_abort' label to ensure the lock is released. This is a local vulnerability requiring the ability to trigger VMA migration.
Affected products
- Linux Linux Kernel 6.19, 7.0.11
Timeline
- 2026-04-25: other: Vulnerability fixed in source code
- 2026-07-19: disclosed: NVD publication date