Executive brief
The Linux kernel's DAMON memory management subsystem fails to properly clean up isolated memory pages when a migration operation is cancelled due to an invalid target location. This causes pages to remain isolated from the system's free-page list indefinitely, preventing them from being reclaimed and potentially pinning physical memory even after the affected process terminates. Systems running vulnerable kernel versions may experience gradual memory pressure and inability to reclaim allocated memory.
Technical details
The vulnerability exists in mm/damon/ops-common.c in the damon_migrate_pages() function. When damon_pa_migrate() or damos_va_migrate() callers isolate memory folios (page structures) into a local list and request migration, the function returns early without restoring folios to the LRU (least-recently-used list) if the target NUMA node is invalid (including NUMA_NO_NODE or -1). These isolated folios retain an extra reference from folio_isolate_lru(), causing them to remain off the LRU indefinitely. The pages cannot be reclaimed by the memory manager while the mapping exists, and dangling references can pin pages even after the process mapping is destroyed. The fix adds a code path to iterate the folio list and call folio_putback_lru() on the invalid-node path, ensuring proper cleanup.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 5deb65c34e682e7c5f5df417a70e223e8fcc5f5a
Timeline
- 2026-08-22: disclosed
- 2026-08-04: patched: Upstream fix commit 5deb65c34e682e7c5f5df417a70e223e8fcc5f5a