CVE-2026-89756: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
In the Linux kernel, the following vulnerability has been resolved:
mm/migrate: report RCU-tasks quiescent states in migratepagesbatch()
migratepagesbatch() unmaps each folio before moving it, and every unmap runs the mmunotifier invalidate callbacks. On KVM hosts trytomigrate() ends up in kvmmmunotifierinvalidaterangestart() -> tdpmmuzapleafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time.
The loop already calls condresched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state.
A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet:
INFO: rcutasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idlecpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdpmmuzapleafs tdpmmunextroot gfntopfncacheinvalidatestart kvmmmunotifierinvalidaterangestart mmunotifierinvalidaterangestart trytomigrateone trytomigrate migratepagesbatch migratepages compactzone compactnode kcompactd kthread
Use condreschedtasksrcuqs() so a quiescent state is reported even when condresched() does nothing.
This has also been discussed at [1]
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to experience this issue?
KVM hosts performing memory migration or compaction are the relevant exposure case, especially when large folio batches trigger expensive KVM MMU notifier invalidation work. The reported affected task is typically a migration worker such as kcompactd.
What conditions lead to the observed stall?
A large migrate_pages_batch() operation repeatedly unmaps folios while KVM invalidation callbacks perform expensive leaf zapping. On preemptible kernels, the existing cond_resched() calls do not report Tasks-RCU quiescent states, allowing the migration task to hold up a Tasks-RCU grace period for minutes.
How can an administrator identify a likely occurrence?
Look for kernel reports stating that RCU Tasks detected stalls, with a migration worker such as kcompactd shown as a running holdout. Stack traces may include migrate_pages_batch, try_to_migrate, kvm_mmu_notifier_invalidate_range_start, and tdp_mmu_zap_leafs.