Executive brief
The Linux kernel's memory migration subsystem could become unstable when moving pages that are held in swap cache. A bug in the page state tracking could cause the system to attempt invalid operations on swap metadata structures, potentially leading to kernel crashes or data corruption. This affects systems using device memory migration features or heavy swap usage.
Technical details
The vulnerability exists in the `__migrate_device_pages()` function in mm/migrate_device.c. The function reads a folio's mapping attribute before calling `folio_free_swap()`, which removes the folio from the swap cache. However, after the swap cache removal, the saved mapping still points to the old swap_space address-space object. When this stale mapping is later passed to `folio_migrate_mapping()`, the function incorrectly attempts to manipulate swap_space.i_pages with invalid reference accounting, triggering a reference count BUG in the kernel. The vulnerability requires local access with user privileges and affects systems performing device memory migration with swapped pages. A patch refreshes the mapping reference after calling `folio_free_swap()` to ensure migration operates on current folio state.
Affected products
- Linux Linux kernel multiple versions (patch available as of 2026-07-28)
Timeline
- 2026-09-11: disclosed: CVE-2026-89755 published
- 2026-07-28: patched: Fix committed to Linux kernel mainline by Arvind Yadav
- 2026-09-21: patched: Backported to stable kernel trees via Greg Kroah-Hartman