CVE-2026-74644 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/ops-common: putback folios on invalid migrate nid
damon_pa_migrate() and damos_va_migrate() isolate folios into a local list and then call damon_migrate_pages(). When target_nid is invalid (including the scheme default NUMA_NO_NODE / -1), damon_migrate_pages() returns early without putting the folios back to the LRU.
Callers then discard the list head while those folios remain isolated with an extra reference taken by folio_isolate_lru(). The pages stay off the LRU for as long as the mapping exists (anon active+inactive counts drop while RSS does not), and the leftover references can pin the pages after the mapping is gone.
Put the folios back on the invalid-nid path so ignored migration requests still return them to the LRU.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel memory management subsystem contains a resource leak vulnerability within the Data Access Monitoring (DAMON) operational logic, specifically affecting functions damon_pa_migrate and damos_va_migrate. These functions are responsible for isolating folios from their respective Least Recently Used lists to facilitate migration between NUMA nodes based on access patterns monitored by DAMON. The core technical flaw occurs when these isolation routines prepare a local list of folios but subsequently invoke the internal helper function damon_migrate_pages with an invalid target node identifier, such as NUMA_NO_NODE or -1. In this scenario, damon_migrate_pages detects the invalid parameter and returns early to prevent erroneous memory operations. However, it fails to trigger the necessary cleanup routine that would return the previously isolated folios back to their respective LRU lists. This creates a state where the kernel has taken an extra reference on each folio via folio_isolate_lru but never releases this isolation because the migration path was abandoned due to invalid input rather than successful completion or explicit error handling of the list itself.
The operational impact of this vulnerability is significant for system stability and memory efficiency, particularly in environments where DAMON schemes are dynamically configured with incorrect NUMA node targets. Because the folios remain isolated from the LRU lists, they become invisible to standard page reclaim mechanisms that rely on these lists to identify pages eligible for swapping or freeing under memory pressure. This results in a gradual depletion of available anonymous active and inactive page counts while the Resident Set Size remains unchanged, effectively masking the true state of memory usage from the kernel's internal accounting systems. Over time, this can lead to severe performance degradation as the system struggles with reduced effective free memory despite physical RAM being largely unused by other processes. Furthermore, if these folios are associated with mappings that persist beyond the lifetime of the DAMON scheme or process, the lingering references can pin those pages in physical memory indefinitely, preventing their release even after the application has terminated and its mapping is gone, leading to persistent resource exhaustion.
From a vulnerability classification perspective, this issue aligns closely with CWE-401, which describes missing release of memory after effective usage, as well as CWE-772, referring to missing reference count decrement or improper cleanup that leads to resource leaks. In the context of the MITRE ATT&CK framework for Linux systems, while not an exploit vector per se, this behavior can be categorized under T1496 Resource Hijacking if leveraged in a denial-of-service capacity by maliciously triggering repeated invalid migration requests to exhaust system memory resources and degrade service availability. The vulnerability highlights a critical gap in error handling paths within the kernel's memory management subsystem where partial state changes are not fully rolled back upon failure conditions.
To mitigate this risk, it is imperative that systems running affected versions of the Linux kernel apply the upstream patch which modifies damon_pa_migrate and damos_va_migrate to ensure folios are returned to the LRU list even when migration fails due to an invalid node identifier. System administrators should verify their DAMON configurations do not specify invalid NUMA nodes, particularly in automated or dynamic monitoring setups where parameters might be derived from external sources without rigorous validation. Regular kernel updates that include this fix must be prioritized to restore proper memory accounting and prevent the gradual accumulation of pinned pages that can eventually lead to out-of-memory conditions or system instability under sustained load.