CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/ops-common: putback folios on invalid migrate nid
damonpamigrate() and damosvamigrate() isolate folios into a local list and then call damonmigratepages(). When targetnid is invalid (including the scheme default NUMANONODE / -1), damonmigratepages() returns early without putting the folios back to the LRU.
Callers then discard the list head while those folios remain isolated with an extra reference taken by folioisolatelru(). The pages stay off the LRU for as long as the mapping exists (anon active+inactive counts drop while RSS does not), and the leftover references can pin the pages after the mapping is gone.
Put the folios back on the invalid-nid path so ignored migration requests still return them to the LRU.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the affected migration path?
The issue occurs when DAMON migration code isolates folios and then calls damon_migrate_pages() with an invalid target NUMA node ID. This includes the default NUMA_NO_NODE value of -1.
What is the operational impact if the condition occurs?
The isolated folios are not returned to the LRU, reducing anonymous active and inactive page counts while RSS remains unchanged. Extra references can also keep pages pinned after their mapping has been removed.
How can I identify a system that may already be affected?
Look for DAMON migration requests using an invalid target_nid, particularly -1, together with anonymous LRU active and inactive counts dropping without a corresponding RSS reduction. Affected pages can remain off the LRU for as long as their mapping exists.
What does the fix change?
The fix returns isolated folios to the LRU when the migration target node ID is invalid, including when the migration request is ignored.