CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios
In the Linux kernel, the following vulnerability has been resolved:
migrate: correct lock ordering for hugetlb file folios
Syzbot has found a deadlock (analyzed by Lance Yang):
1) Task (5749): Holds foliolock, then tries to acquire immaprwsem(read lock). 2) Task (5754): Holds immaprwsem(write lock), then tries to acquire foliolock.
migratepages() -> migratehugetlbs() -> unmapandmovehugepage() <- Takes foliolock! -> removemigrationptes() -> rmapwalkfile() -> immaplockread() <- Waits for immaprwsem(read lock)!
hugetlbfsfallocate() -> hugetlbfspunchhole() <- Takes immaprwsem(write lock)! -> hugetlbfszeropartialpage() -> filemaplockhugetlbfolio() -> filemaplockfolio() -> filemapgetfolio <- Waits for foliolock!
The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing immaplock to cover the calls to removemigrationptes() too.
This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes(), ensuring i_mmap_rwsem is held across remove_migration_ptes() to correct lock ordering for hugetlb file folios.
Linux kernel (mm/rmap.c) i_mmap_lock scope = expanded to cover remove_migration_ptes()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23097?
CVE-2026-23097 has been rated with a severity that necessitates immediate attention due to potential deadlock risks in the Linux kernel.
How do I fix CVE-2026-23097?
To resolve CVE-2026-23097, update the Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-23097?
CVE-2026-23097 affects the Linux kernel, specifically versions prior to the fixes implemented for this vulnerability.
What is the nature of the vulnerability described in CVE-2026-23097?
CVE-2026-23097 involves a deadlock scenario caused by incorrect lock ordering for hugetlb file folios in the Linux kernel.
Who discovered CVE-2026-23097?
CVE-2026-23097 was discovered by Syzbot, with analysis conducted by Lance Yang.