CVE-2026-80729: mm/huge_memory: initialise workingset state before folio split
In the Linux kernel, the following vulnerability has been resolved:
mm/hugememory: initialise workingset state before folio split
xastrysplit() adds GFPACCOUNT for page-cache xanodes, but foliosplit() leaves the xastate's xalru unset. That lets a live, memcg-charged xanode exist without being linked into the mapping's shadownodes listlru; when reclaim later walks the listlru it trips VMWARNON(!cssisdying()).
Use mappingsetupdate() to install both the workingset update callback and the shadownodes listlru on the xastate.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the warning?
The issue requires a folio split that leaves a live, memcg-charged page-cache xarray node without the mapping's shadow_nodes list_lru linkage. A later reclaim walk of that list_lru can then trigger VM_WARN_ON(!css_is_dying()).
How can I tell whether a system has encountered this issue?
Affected systems may report a VM_WARN_ON(!css_is_dying()) warning during reclaim. The described condition involves memcg-charged xa_nodes associated with page-cache folio splitting.
What does the fix change?
The fix uses mapping_set_update() before the folio split path so the xa_state receives both the workingset update callback and the shadow_nodes list_lru. This prevents a live memcg-charged xa_node from existing without the required list_lru linkage.