CVE-2026-89756

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

migrate_pages_batch() unmaps each folio before moving it, and every

unmap runs the mmu_notifier invalidate callbacks. On KVM hosts

try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() ->

tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps

the CPU busy for a long time.

The loop already calls cond_resched(), but on PREEMPTION kernels that is

a no-op, and involuntary preemption is not a Tasks-RCU quiescent state.

A long batch therefore never reports a quiescent state, and the

migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the

Tasks-RCU grace period for minutes, which is common at Meta fleet:

INFO: rcu_tasks detected stalls on tasks:

0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task

Call Trace:

tdp_mmu_zap_leafs

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References