In the Linux kernel, the following vulnerability has been resolved:
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0.
Similarly, if migration failed, memcg_data of the dst folio is left unset.
If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests:
# ./hmm-tests ... # RUN hmm.hmm_device_private.migrate ... [ 102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00 [ 102.079974][T14893] anon flags: 0x17ff00000020018(uptodate|dirty|swapbacked|node=0|zone=2|lastcpupid=0x7ff) [ 102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9 [ 102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000 [ 102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 102.087230][T14893] ------------[ cut here ]------------ [ 102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.090478][T14893] Modules linked in: [ 102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151 [ 102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 [ 102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.096104][T14893] Code: ... [ 102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293 [ 102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426 [ 102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880 [ 102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 102.105757][T14893] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900236c37d8 [ 102.107296][T14893] R13: ffff888277a2bcb0 R14: 000000000000001f R15: 0000000000000000 [ 102.108830][T14893] FS: 00007ff27dbdd740(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 [ 102.110643][T14893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.111924][T14893] CR2: 00007ff27d400000 CR3: 000000010866e000 CR4: 0000000000750ef0 [ 102.113478][T14893] PKRU: 55555554 [ 102.114172][T14893] Call Trace: [ 102.114805][T14893] <TASK> [ 102.115397][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.116547][T14893] ? __warn.cold+0x110/0x210 [ 102.117461][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.118667][T14893] ? report_bug+0x1b9/0x320 [ 102.119571][T14893] ? handle_bug+0x54/0x90 [ 102.120494][T14893] ? exc_invalid_op+0x17/0x50 [ 102.121433][T14893] ? asm_exc_invalid_op+0x1a/0x20 [ 102.122435][T14893] ? __wake_up_klogd.part.0+0x76/0xd0 [ 102.123506][T14893] ? dump_page+0x4f/0x60 [ 102.124352][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.125500][T14893] folio_batch_move_lru+0xd4/0x200 [ 102.126577][T14893] ? __pfx_lru_add+0x10/0x10 [ 102.127505][T14893] __folio_batch_add_and_move+0x391/0x720 [ 102.128633][T14893] ? __pfx_lru_add+0x10/0x10 [ 102.129550][T14893] folio_putback_lru+0x16/0x80 [ 102.130564][T14893] migrate_device_finalize+0x9b/0x530 [ 102.131640][T14893] dmirror_migrate_to_device.constprop.0+0x7c5/0xad0 [ 102.133047][T14893] dmirror_fops_unlocked_ioctl+0x89b/0xc80
Likely, nothing else goes wrong: putting the last folio reference will remove the folio from the LRU again. So besides memcg complaining, adding the folio to be freed to the LRU is just an unnecessary step.
The new flow resembles what we have in migrate_folio_move(): add the dst to the lru, rem ---truncated---
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libperfUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-debug-develUpgrade kernel-devel-matchedUpgrade kernel-toolsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64kUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-develUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-debug-develUpgrade rtlaUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-rt-modulesUpgrade kernel-docUpgrade kernel-rt-64k-debug-modules-coreUpgrade rvUpgrade perfUpgrade python3-perfUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-coreUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debugUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-develUpgrade kernel-64kUpgrade kernel-cross-headersUpgrade kernel-coreUpgrade kernel-rtUpgrade kernel-zfcpdumpUpgrade kernel-64k-develUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-64k-debug-develUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debug-devel-matched | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | May 15, 2025 | Mar 12, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools | Jun 13, 2025 | Mar 12, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Jul 21, 2025 | Mar 12, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-tools | Jul 1, 2025 | Mar 12, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Mar 12, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Mar 12, 2025 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade perf-debuginfoUpgrade rvUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade libperf-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernelUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade libperfUpgrade kernel-rt-debuginfoUpgrade kernel-toolsUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-uki-virtUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade python3-perfUpgrade rtlaUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libs | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade dlm-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade dtb-armUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-apmUpgrade reiserfs-kmp-64kbUpgrade kernel-sourceUpgrade kernel-symsUpgrade kernel-syms-azureUpgrade kernel-azure-develUpgrade dtb-socionextUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-rt-vdsoUpgrade dtb-freescaleUpgrade kernel-docs-htmlUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-default-develUpgrade kernel-devel-azureUpgrade kernel-source-rtUpgrade kselftests-kmp-defaultUpgrade dtb-lgUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-rtUpgrade dtb-rockchipUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debugUpgrade dtb-amazonUpgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade dtb-marvellUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade dtb-broadcomUpgrade kernel-develUpgrade dtb-sprdUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-appleUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-obs-buildUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade kernel-debug-vdsoUpgrade kernel-64kb-develUpgrade kernel-azure-extraUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade kernel-defaultUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade dtb-alteraUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade kernel-azure-optionalUpgrade kernel-rt-extraUpgrade kernel-debug-develUpgrade gfs2-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-hisiliconUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatchUpgrade dtb-allwinnerUpgrade kselftests-kmp-azureUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-debug | Dec 5, 2025 | Jun 12, 2025 |
| Ubuntu | — | Upgrade linux-image-gkeopUpgrade linux-image-azureUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1035-raspiUpgrade linux-image-nvidia-5.15Upgrade linux-image-aws-6.8Upgrade linux-image-ibmUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1100-aws-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1094-ibmUpgrade linux-image-5.15.0-1052-nvidia-tegra-rtUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1095-intel-iotgUpgrade linux-image-5.15.0-170-generic-lpaeUpgrade linux-image-5.15.0-1092-kvmUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1019-gkeopUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-5.15.0-1109-azureUpgrade linux-image-raspi-realtimeUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-5.15.0-1100-awsUpgrade linux-image-aws-lts-22.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-nvidiaUpgrade linux-image-intelUpgrade linux-image-5.15.0-1064-xilinx-zynqmpUpgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracle-5.15Upgrade linux-image-fips-5.15Upgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1096-gkeUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-ibm-6.8Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-fipsUpgrade linux-image-azure-fdeUpgrade linux-image-azure-fips-5.15Upgrade linux-image-6.8.0-1035-nvidiaUpgrade linux-image-6.8.0-2028-raspi-realtimeUpgrade linux-image-6.8.1-1030-realtimeUpgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-170-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-170-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-5.15.0-170-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1100-aws-fipsUpgrade linux-image-lowlatency-64kUpgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-intel-iotgUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-generic-5.15Upgrade linux-image-azure-lts-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-azure-nvidiaUpgrade linux-image-5.15.0-1095-nvidiaUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1041-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-6.8.0-1035-nvidia-lowlatency-64kUpgrade linux-image-generic-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-78-lowlatency-64kUpgrade linux-image-5.15.0-1041-nvidia-tegra-igxUpgrade linux-image-raspi-nolpaeUpgrade linux-image-nvidia-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1035-awsUpgrade linux-image-azure-cvmUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-1036-gcpUpgrade linux-image-aws-64kUpgrade linux-image-5.15.0-1099-realtimeUpgrade linux-image-realtimeUpgrade linux-image-5.15.0-1095-nvidia-lowlatencyUpgrade linux-image-azure-fde-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1035-aws-64kUpgrade linux-image-6.8.0-78-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-aws-64k-5.15Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-5.15Upgrade linux-image-kvmUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1033-ibmUpgrade linux-image-gkeUpgrade linux-image-gcp-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-78-genericUpgrade linux-image-5.15.0-1100-gcpUpgrade linux-image-5.15.0-1092-intel-iot-realtimeUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-5.15.0-170-genericUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-raspi-5.15Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1035-nvidia-lowlatencyUpgrade linux-image-azure-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-raspi-6.8Upgrade linux-image-generic-64k-5.15Upgrade linux-image-6.8.0-78-generic-64kUpgrade linux-image-azure-6.8Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1032-gkeUpgrade linux-image-oem-20.04dUpgrade linux-image-gcp-5.15Upgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-aws-fips-5.15Upgrade linux-image-6.8.0-1032-oracleUpgrade linux-image-6.8.0-1032-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-aws-5.15Upgrade linux-image-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-generic-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1100-gcp-fipsUpgrade linux-image-6.8.0-1035-nvidia-64kUpgrade linux-image-5.15.0-1052-nvidia-tegraUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-1083-gkeopUpgrade linux-image-5.15.0-170-lowlatencyUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-oem-22.04bUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1034-azureUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1036-gcp-64kUpgrade linux-image-5.15.0-1110-azureUpgrade linux-image-awsUpgrade linux-image-realtime-5.15Upgrade linux-image-oracle-6.8Upgrade linux-image-5.15.0-1097-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-5.15Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-generic-hwe-22.04 | Jun 26, 2025 | Mar 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Mar 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub