Executive brief
A memory management issue in the Linux kernel's multi-generational LRU (mglru) subsystem causes incorrect handling of unevictable memory pages, leading to memory accounting inaccuracies and pages remaining incorrectly marked as locked in memory. This can result in inflated memory statistics and potential issues with memory reclamation behavior in systems using mglru.
Technical details
The vulnerability exists in the sort_folio() function within the multi-generational LRU memory management subsystem. The buggy shortcut for moving unevictable folios fails to properly initialize the mlock_count field, which aliases the folio->lru member. This causes mlock_count to be poisoned with LIST_POISON2 (0x122/290), and subsequent munlock operations fail to clear the PG_mlocked flag because the decremented bogus count remains non-zero. Additionally, the shortcut calls lru_gen_del_folio() while PG_lru is still set, creating a race condition where concurrent operations like compaction can succeed on folios already removed from generation lists. The fix isolates these folios as common folios and processes them through the generic shrink path, matching classical LRU behavior. No patches are yet available as this appears to be a recently disclosed pre-release vulnerability.
Affected products
- Linux Linux kernel versions supporting mglru before the fix
Timeline
- 2026-09-11: disclosed