mm/mglru: fix and remove redundant unevictable folio handling
In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort_folio() has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru usage convention, and it has a more serious issue. Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that folio->lru can be reused to hold folio->mlock_count (see the comment in lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them, and every other place that turns a folio unevictable initialises mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and __mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio() sets nothing, and the lru_gen_del_folio() right above it may have already poisoned folio->lru via list_del(), so mlock_count ends up aliasing LIST_POISON2, which reads as 0x122, i.e. 290. The result is user visible. On munlock, __munlock_folio() decrements that bogus count, finds it still non-zero and bails out before clearing PG_mlocked, so the folio remains unevictable and the Mlocked accounting stays inflated until the folio is freed. The shortcut also touches the LRU flags in the wrong order. It calls lru_gen_del_folio() while PG_lru is still set, so a concurrent folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed on a folio that has already been taken off the generation list, which
CVE-2026-89757
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89757
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"lessThan": "b1d7c69e6c7d3ec47513b911ce7529e56d183dad",
"versionType": "git"
},
{
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"lessThan": "49193dac48d30eee2a21da88a7262d52a7feefae",
"versionType": "git"
},
{
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"lessThan": "54a58d6656dd403b686b247f0bad8507cbfb45df",
"versionType": "git"
},
{
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"lessThan": "15d3a2a71c8bf7333d019d249ee33669e69e4275",
"versionType": "git"
},
{
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"lessThan": "f7e698e326b239a91ea15844817551921209e826",
"versionType": "git"
}
],
"programFiles": [
"mm/vmscan.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"mm/vmscan.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89757
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46719 · Revision 1
- Added to Heist Feed
- Publisher date