Linux Kernel up to 7.0.3 mm migrate_folio_move race condition

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.0.3 and classified as problematic. Affected by this issue is the function migrate_folio_move of the component mm. The manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2026-46017. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.0.3. This issue affects the function migrate_folio_move of the component mm. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: mm: fix deferred split queue races during migration migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio(). Move the requeue before remove_migration_ptes() so dst is back on the deferred split queue before it becomes visible again. Because migration still holds dst locked at that point, teach deferred_split_scan() to requeue a folio when folio_trylock() fails. Otherwise a fully mapped underused folio can be dequeued by the shrinker and silently lost from split_queue. [[email protected]: move the comment]

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-46017 since 05/13/2026. Technical details are known, but no exploit is available.

Upgrading to version 7.0.4 or 7.1-rc1 eliminates this vulnerability. Applying the patch cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa/3bac01168982ec3e3bf87efdc1807c7933590a85 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion