{"id":"CVE-2026-80729","revision":"a48a77b05b8c402d86a3affaf5a51a85","records":[{"revision":"a48a77b05b8c402d86a3affaf5a51a85","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80729","aliases":[],"title":"mm/huge_memory: initialise workingset state before folio split","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: initialise workingset state before folio split\n\nxas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but\n__folio_split() leaves the xa_state's xa_lru unset.  That lets a live,\nmemcg-charged xa_node exist without being linked into the mapping's\nshadow_nodes list_lru; when reclaim later walks the list_lru it trips\nVM_WARN_ON(!css_is_dying()).\n\nUse mapping_set_update() to install both the workingset update callback\nand the shadow_nodes list_lru on the xa_state.","state":0,"publishedAt":"2026-09-03T08:21:47.722+00:00","modifiedAt":"2026-10-11T13:47:11.562+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/huge_memory.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"58729c04cf1092b87aeef0bf0998c9e2e4771133\",\n                            \"lessThan\": \"dc87b56b43c9143f2405e434cff1530c3488b571\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"58729c04cf1092b87aeef0bf0998c9e2e4771133\",\n                            \"lessThan\": \"d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"58729c04cf1092b87aeef0bf0998c9e2e4771133\",\n                            \"lessThan\": \"aca1f2d5de17e138bc6c4859126b77e516b82541\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/huge_memory.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/dc87b56b43c9143f2405e434cff1530c3488b571","https://git.kernel.org/stable/c/d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55","https://git.kernel.org/stable/c/aca1f2d5de17e138bc6c4859126b77e516b82541"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80729","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80729","identifiers":["CVE-2026-80729"]},"retained":false,"historicalAffected":[]}],"coverage":[]}