CVE-2026-89755: mm/migrate_device: clear stale mapping after freeing swapcache

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm/migratedevice: clear stale mapping after freeing swapcache

migratedevicepages() reads the folio mapping before calling foliofreeswap(). When foliofreeswap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swapspace.

Passing the stale mapping to foliomigratemapping() makes it use the mapped-folio path for a folio that is no longer in swapcache. It can then operate on swapspace.ipages with invalid reference accounting, eventually triggering a folio reference count BUG.

After a successful split, nr still contains the number of pages in the original large folio, although each resulting page is now a separate order-0 folio. Reset nr to 1 so each split folio is processed separately, including its own swapcache removal and mapping lookup.

Refresh the saved mapping after foliofreeswap() so the current folio state is used during migration.

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

What conditions are needed to trigger the issue?

The issue occurs during device-page migration when a folio has swap cache removed successfully and migration subsequently uses a stale saved mapping. It also involves handling of a split large folio, where the page count must be reset so each resulting order-0 folio is processed independently.

2

What is the observable impact if the vulnerable path is reached?

Migration can operate on swap_space.i_pages using invalid reference accounting after the folio is no longer in swap cache. This can eventually trigger a folio reference count BUG.

3

How does the fix prevent the failure?

The fix refreshes the folio mapping after folio_free_swap() so migration uses the folio's current state. It also resets nr to 1 after a successful split, ensuring each resulting folio receives its own swap-cache removal and mapping lookup.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203