CVE-2026-89756: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate: report RCU-tasks quiescent states in migratepagesbatch()

migratepagesbatch() unmaps each folio before moving it, and every unmap runs the mmunotifier invalidate callbacks. On KVM hosts trytomigrate() ends up in kvmmmunotifierinvalidaterangestart() -> tdpmmuzapleafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time.

The loop already calls condresched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state.

A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet:

INFO: rcutasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idlecpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdpmmuzapleafs tdpmmunextroot gfntopfncacheinvalidatestart kvmmmunotifierinvalidaterangestart mmunotifierinvalidaterangestart trytomigrateone trytomigrate migratepagesbatch migratepages compactzone compactnode kcompactd kthread

Use condreschedtasksrcuqs() so a quiescent state is reported even when condresched() does nothing.

This has also been discussed at [1]

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

Which systems are most likely to experience this issue?

KVM hosts performing memory migration or compaction are the relevant exposure case, especially when large folio batches trigger expensive KVM MMU notifier invalidation work. The reported affected task is typically a migration worker such as kcompactd.

2

What conditions lead to the observed stall?

A large migrate_pages_batch() operation repeatedly unmaps folios while KVM invalidation callbacks perform expensive leaf zapping. On preemptible kernels, the existing cond_resched() calls do not report Tasks-RCU quiescent states, allowing the migration task to hold up a Tasks-RCU grace period for minutes.

3

How can an administrator identify a likely occurrence?

Look for kernel reports stating that RCU Tasks detected stalls, with a migration worker such as kcompactd shown as a running holdout. Stack traces may include migrate_pages_batch, try_to_migrate, kvm_mmu_notifier_invalidate_range_start, and tdp_mmu_zap_leafs.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203