{"id":"CVE-2026-23097","revision":"35707fc864844ce3ac13aa1e314233c4","records":[{"revision":"35707fc864844ce3ac13aa1e314233c4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23097","aliases":[],"title":"migrate: correct lock ordering for hugetlb file folios","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmigrate: correct lock ordering for hugetlb file folios\n\nSyzbot has found a deadlock (analyzed by Lance Yang):\n\n1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).\n2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire\nfolio_lock.\n\nmigrate_pages()\n  -> migrate_hugetlbs()\n    -> unmap_and_move_huge_page()     <- Takes folio_lock!\n      -> remove_migration_ptes()\n        -> __rmap_walk_file()\n          -> i_mmap_lock_read()       <- Waits for i_mmap_rwsem(read lock)!\n\nhugetlbfs_fallocate()\n  -> hugetlbfs_punch_hole()           <- Takes i_mmap_rwsem(write lock)!\n    -> hugetlbfs_zero_partial_page()\n     -> filemap_lock_hugetlb_folio()\n      -> filemap_lock_folio()\n        -> __filemap_get_folio        <- Waits for folio_lock!\n\nThe migration path is the one taking locks in the wrong order according to\nthe documentation at the top of mm/rmap.c.  So expand the scope of the\nexisting i_mmap_lock to cover the calls to remove_migration_ptes() too.\n\nThis is (mostly) how it used to be after commit c0d0381ade79.  That was\nremoved by 336bf30eb765 for both file & anon hugetlb pages when it should\nonly have been removed for anon hugetlb pages.","state":0,"publishedAt":"2026-02-04T16:08:19.815+00:00","modifiedAt":"2026-10-19T18:25:30.652+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/migrate.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"e7396d23f9d5739f56cf9ab430c3a169f5508394\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"ad97b9a55246eb940a26ac977f80892a395cabf9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"5edb9854f8df5428b40990a1c7d60507da5bd330\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"526394af4e8ade89cacd1a9ce2b97712712fcc34\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"b75070823b89009f5123fd0e05a8e0c3d39937c1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"1b68efce6dd483d22f50d0d3800c4cfda14b1305\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\",\n                            \"lessThan\": \"b7880cb166ab62c2409046b2347261abf701530e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ef792d6ce0db6a56e56743b1de1716a982c3b851\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.9.9\",\n                            \"lessThan\": \"5.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/migrate.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.249\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.199\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.162\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.122\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.68\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.8\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e7396d23f9d5739f56cf9ab430c3a169f5508394","https://git.kernel.org/stable/c/ad97b9a55246eb940a26ac977f80892a395cabf9","https://git.kernel.org/stable/c/5edb9854f8df5428b40990a1c7d60507da5bd330","https://git.kernel.org/stable/c/526394af4e8ade89cacd1a9ce2b97712712fcc34","https://git.kernel.org/stable/c/b75070823b89009f5123fd0e05a8e0c3d39937c1","https://git.kernel.org/stable/c/1b68efce6dd483d22f50d0d3800c4cfda14b1305","https://git.kernel.org/stable/c/b7880cb166ab62c2409046b2347261abf701530e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23097","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23097","identifiers":["CVE-2026-23097"]},"retained":false,"historicalAffected":[]}],"coverage":[]}