UBUNTU-CVE-2026-80729: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: initialise workingset state before folio split xastrysplit() adds GFPACCOUNT for page-cache xanodes, but foliosplit() leaves the xastate's xalru unset. That lets a live, memcg-charged xanode exist without being linked into the mapping's shadownodes listlru; when reclaim later walks the listlru it trips VMWARNON(!cssisdying()). Use mappingsetupdate() to install both the workingset update callback and the shadownodes listlru on the xastate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel mm/huge_memory folio-split path, use mapping_set_update() to install both the workingset update callback and the shadow_nodes list_lru on the xa_state before splitting the folio.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition triggers the faulty state?
The issue occurs when a folio split creates a memcg-charged page-cache xarray node but leaves the xarray state without the mapping's shadow_nodes list_lru and workingset update callback.
What is the observable consequence on an affected system?
During reclaim, walking the shadow_nodes list_lru can trigger VM_WARN_ON(!css_is_dying()) because a live memcg-charged xarray node was not linked into that list.