CVE-2026-89986

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()

syzbot reported a sleeping function called from invalid context splat in

bucket_table_alloc().

When rhashtable_insert_slow() rehashes the table under rcu_read_lock(), it

calls bucket_table_alloc(..., GFP_ATOMIC | __GFP_NOWARN). If the bucket

table allocation uses vmalloc, __vmalloc_node_range_noprof() invokes

vm_area_alloc_pages() -> alloc_pages_bulk_mempolicy_noprof() with the

passed GFP_ATOMIC flags.

If the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy,

alloc_pages_bulk_weighted_interleave() is called and currently hardcodes

GFP_KERNEL when allocating the temporary weights array, triggering a

might_alloc() splat in atomic/RCU contexts.

Pass the gfp flags (masked with GFP_RECLAIM_MASK to strip page-allocator

zone modifiers like __GFP_HIGHMEM) received by

alloc_pages_bulk_weighted_interleave() to kmalloc() instead of hardcodi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References