{"id":"CVE-2026-89756","revision":"98929aabeb8e4bc997c41ef278ff324b","records":[{"revision":"98929aabeb8e4bc997c41ef278ff324b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89756","aliases":[],"title":"mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()\n\nmigrate_pages_batch() unmaps each folio before moving it, and every\nunmap runs the mmu_notifier invalidate callbacks.  On KVM hosts\ntry_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() ->\ntdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps\nthe CPU busy for a long time.\n\nThe loop already calls cond_resched(), but on PREEMPTION kernels that is\na no-op, and involuntary preemption is not a Tasks-RCU quiescent state.\n\nA long batch therefore never reports a quiescent state, and the\nmigrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the\nTasks-RCU grace period for minutes, which is common at Meta fleet:\n\n  INFO: rcu_tasks detected stalls on tasks:\n  0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0      state:R  running task\n  Call Trace:\n   tdp_mmu_zap_leafs\n   tdp_mmu_next_root\n   gfn_to_pfn_cache_invalidate_start\n   kvm_mmu_notifier_invalidate_range_start\n   __mmu_notifier_invalidate_range_start\n   try_to_migrate_one\n   try_to_migrate\n   migrate_pages_batch\n   migrate_pages\n   compact_zone\n   compact_node\n   kcompactd\n   kthread\n\nUse cond_resched_tasks_rcu_qs() so a quiescent state is reported even\nwhen cond_resched() does nothing.\n\nThis has also been discussed at [1]","state":0,"publishedAt":"2026-09-11T19:46:59.093+00:00","modifiedAt":"2026-10-19T08:52:09.9+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/migrate.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8315f42295d2667a7f942f154b73a86fd7cb2227\",\n                            \"lessThan\": \"8c6d63d434ebb85c6cf3dac1e70a171b183c6614\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8315f42295d2667a7f942f154b73a86fd7cb2227\",\n                            \"lessThan\": \"4757542649af56d894e25e30f57cd497dffad53f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8315f42295d2667a7f942f154b73a86fd7cb2227\",\n                            \"lessThan\": \"4996a7bc01ef35570664854dac2530c604981039\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8315f42295d2667a7f942f154b73a86fd7cb2227\",\n                            \"lessThan\": \"5dc0daff0341c6baba19c38f47d299ac831d7e99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8315f42295d2667a7f942f154b73a86fd7cb2227\",\n                            \"lessThan\": \"66734981b4d3c105223a13c827c9c73be18d91ad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8315f42295d2667a7f942f154b73a86fd7cb2227\",\n                            \"lessThan\": \"efe8f86c0916f0f74eea74ae21a3b37f728c6bad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/migrate.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8c6d63d434ebb85c6cf3dac1e70a171b183c6614","https://git.kernel.org/stable/c/4757542649af56d894e25e30f57cd497dffad53f","https://git.kernel.org/stable/c/4996a7bc01ef35570664854dac2530c604981039","https://git.kernel.org/stable/c/5dc0daff0341c6baba19c38f47d299ac831d7e99","https://git.kernel.org/stable/c/66734981b4d3c105223a13c827c9c73be18d91ad","https://git.kernel.org/stable/c/efe8f86c0916f0f74eea74ae21a3b37f728c6bad"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89756","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89756","identifiers":["CVE-2026-89756"]},"retained":false,"historicalAffected":[]}],"coverage":[]}