GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46017 (GCVE-0-2026-46017)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:56 – Updated: 2026-06-14 17:48
VLAI
Title
mm: fix deferred split queue races during migration
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: fix deferred split queue races during migration migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio(). Move the requeue before remove_migration_ptes() so dst is back on the deferred split queue before it becomes visible again. Because migration still holds dst locked at that point, teach deferred_split_scan() to requeue a folio when folio_trylock() fails. Otherwise a fully mapped underused folio can be dequeued by the shrinker and silently lost from split_queue. [ziy@nvidia.com: move the comment]
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3bac01168982ec3e3bf87efdc1807c7933590a85 (git)
Affected: 0 , < 7.0.4 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 7.0.4 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c",
            "mm/migrate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3bac01168982ec3e3bf87efdc1807c7933590a85",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c",
            "mm/migrate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix deferred split queue races during migration\n\nmigrate_folio_move() records the deferred split queue state from src and\nreplays it on dst.  Replaying it after remove_migration_ptes(src, dst, 0)\nmakes dst visible before it is requeued, so a concurrent rmap-removal path\ncan mark dst partially mapped and trip the WARN in deferred_split_folio().\n\nMove the requeue before remove_migration_ptes() so dst is back on the\ndeferred split queue before it becomes visible again.\n\nBecause migration still holds dst locked at that point, teach\ndeferred_split_scan() to requeue a folio when folio_trylock() fails. \nOtherwise a fully mapped underused folio can be dequeued by the shrinker\nand silently lost from split_queue.\n\n[ziy@nvidia.com: move the comment]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:48:14.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85"
        }
      ],
      "title": "mm: fix deferred split queue races during migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46017",
    "datePublished": "2026-05-27T12:56:18.800Z",
    "dateReserved": "2026-05-13T15:03:33.092Z",
    "dateUpdated": "2026-06-14T17:48:14.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46017",
      "date": "2026-09-16",
      "epss": "0.00105",
      "percentile": "0.01184"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:52:19.000Z",
      "cve": "CVE-2026-46017",
      "id": "msrc_CVE-2026-46017",
      "initial_release_date": "2026-05-28T01:06:52.000Z",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm: fix deferred split queue races during migration",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46017.json",
      "version": "8"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46017\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:20.133\",\"lastModified\":\"2026-06-17T10:52:54.363\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: fix deferred split queue races during migration\\n\\nmigrate_folio_move() records the deferred split queue state from src and\\nreplays it on dst.  Replaying it after remove_migration_ptes(src, dst, 0)\\nmakes dst visible before it is requeued, so a concurrent rmap-removal path\\ncan mark dst partially mapped and trip the WARN in deferred_split_folio().\\n\\nMove the requeue before remove_migration_ptes() so dst is back on the\\ndeferred split queue before it becomes visible again.\\n\\nBecause migration still holds dst locked at that point, teach\\ndeferred_split_scan() to requeue a folio when folio_trylock() fails. \\nOtherwise a fully mapped underused folio can be dequeued by the shrinker\\nand silently lost from split_queue.\\n\\n[ziy@nvidia.com: move the comment]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/huge_memory.c\",\"mm/migrate.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3bac01168982ec3e3bf87efdc1807c7933590a85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/huge_memory.c\",\"mm/migrate.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"F21141B5-2B3E-45C6-9CE4-E6C39F52DA30\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:40:35+00:00",
      "cve": "CVE-2026-46017",
      "id": "CVE-2026-46017",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: fix deferred split queue races during migration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46017.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T16:57:20Z",
      "cve": "CVE-2026-46017",
      "id": "CVE-2026-46017",
      "initial_release_date": "2026-05-28T03:54:19Z",
      "product_status:known_not_affected": "299",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46017",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46017.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.