CVE-2026-80729 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: initialise workingset state before folio split
xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but __folio_split() leaves the xa_state's xa_lru unset. That lets a live, memcg-charged xa_node exist without being linked into the mapping's shadow_nodes list_lru; when reclaim later walks the list_lru it trips VM_WARN_ON(!css_is_dying()).
Use mapping_set_update() to install both the workingset update callback and the shadow_nodes list_lru on the xa_state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel vulnerability identified in mm/huge_memory involves a critical initialization defect within the memory management subsystem, specifically affecting how huge pages are handled during split operations. The core technical flaw resides in the interaction between xas_try_split and __folio_split functions when managing page-cache xa_nodes. When xas_try_split executes, it correctly adds the __GFP_ACCOUNT flag to ensure proper accounting of resources for page-cache xa_nodes. However, the subsequent call to __folio_split fails to initialize a crucial component: the xa_lru field within the xa_state structure remains unset. This omission creates an inconsistent state where a live memory control group charged xa_node exists in memory but is not properly linked into the mapping's shadow_nodes list_lru data structure.
This lack of linkage has significant operational consequences for the kernel's virtual memory management and reclaim mechanisms. When the system attempts to perform memory reclamation, it walks through the list_lru structures to identify and manage pages that can be freed or moved. Because the xa_node was not linked into shadow_nodes due to the uninitialized xa_lru field, the reclaim process encounters an unexpected state during this traversal. Specifically, the code triggers a VM_WARN_ON condition checking if css_is_dying is false while expecting it to be true in certain contexts related to cgroup lifecycle management. This warning indicates that the kernel has detected an inconsistency between the expected and actual state of memory control group resources, which can lead to instability or incorrect resource accounting during heavy memory pressure scenarios.
From a vulnerability classification perspective, this issue aligns with CWE-665, Improper Initialization, as it stems from failing to properly initialize data structures before they are used in critical operations. Furthermore, the impact on system stability and potential for denial of service through kernel warnings or crashes relates to availability impacts often associated with improper resource management flaws. The ATT&CK framework does not directly map this specific internal kernel logic error to a tactical technique as it is an implementation defect rather than an exploit vector, but it highlights weaknesses in defensive coding practices regarding state consistency checks within the operating system core.
The resolution involves modifying the memory management code to ensure that workingset update callbacks and shadow_nodes list_lru structures are correctly installed on the xa_state before any split operations proceed. By utilizing mapping_set_update(), developers can guarantee that both the necessary callback mechanisms and the linked-list infrastructure are established prior to the folio being split. This ensures that all memcg-charged nodes remain properly tracked within their respective shadow lists, preventing the orphaned state that triggers the VM_WARN_ON condition during reclaim walks.
To mitigate similar issues in future development cycles, engineers should enforce strict initialization protocols for any data structures involved in memory accounting and page management. Code reviews must specifically check for completeness of setup routines when modifying core kernel subsystems like huge pages handling. Additionally, implementing more robust sanity checks that verify linkage integrity before allowing operations on these structures can prevent such inconsistencies from manifesting as runtime warnings or crashes. Updating to the latest stable version of the Linux kernel containing this patch is essential for systems relying on accurate memory accounting and stability under high load conditions involving transparent huge pages.