CVE-2026-46017 Overview
CVE-2026-46017 is a race condition in the Linux kernel memory management (mm) subsystem. The flaw occurs during folio migration when migrate_folio_move() records the deferred split queue state from the source folio and replays it on the destination. The original ordering placed the replay after remove_migration_ptes(src, dst, 0), exposing the destination folio before requeue. A concurrent reverse mapping (rmap) removal path could then mark the destination as partially mapped and trigger a WARN in deferred_split_folio().
Critical Impact
Concurrent rmap-removal during folio migration can corrupt the deferred split queue state, generate kernel warnings, and cause fully mapped underused folios to be silently lost from split_queue.
Affected Products
- Linux kernel (mainline) versions containing the deferred split queue migration logic
- Linux kernel stable branches prior to the fix commits 3bac011689 and cbf75cf212
- Distributions shipping affected upstream kernels
Discovery Timeline
- 2026-05-27 - CVE-2026-46017 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46017
Vulnerability Analysis
The defect lives in the memory migration path. When the kernel migrates a folio, migrate_folio_move() transfers the deferred split queue state from source to destination so the shrinker can later split underused large folios. The original code requeued the destination folio after calling remove_migration_ptes(src, dst, 0), which restores page table entries pointing at dst. Once those PTEs are installed, other CPUs can perform rmap walks against dst while it is not yet on the deferred split queue.
A concurrent rmap-removal path observing the partially mapped state hits the warning inside deferred_split_folio() because the folio is visible but unqueued. The fix reorders operations so the requeue happens before remove_migration_ptes(), ensuring dst rejoins the deferred split queue before becoming externally visible.
A secondary issue affects deferred_split_scan(). Because migration still holds dst locked when the shrinker runs, folio_trylock() can fail. Without the patch, the shrinker dequeues the folio and discards it, silently losing it from split_queue. The fix teaches the scanner to requeue on folio_trylock() failure.
Root Cause
The root cause is an ordering and locking race condition [CWE-362] between folio migration and concurrent rmap operations. State updates required for safe shrinker interaction were performed after the destination folio became visible to other kernel paths.
Attack Vector
Triggering the race requires concurrent memory pressure that drives folio migration, rmap teardown, and deferred split shrinker activity. The reported impact is a kernel WARN and silent loss of folios from the split queue. No public exploit is available, and the issue is treated as a stability and correctness fix rather than a confirmed privilege escalation primitive.
The vulnerability is described in the upstream commits without proof-of-concept code. See the kernel commit 3bac011689 and kernel commit cbf75cf212 for the patches.
Detection Methods for CVE-2026-46017
Indicators of Compromise
- Kernel log entries containing the WARN from deferred_split_folio() referencing partially mapped folio state
- Unexpected growth of unsplittable large folios under memory pressure workloads
- Kernel stack traces involving migrate_folio_move, remove_migration_ptes, and deferred_split_scan
Detection Strategies
- Monitor dmesg and /var/log/kern.log for warnings emitted from mm/huge_memory.c related to deferred split queue state.
- Audit running kernel versions against the fixed stable commits 3bac011689 and cbf75cf212 using uname -r and distribution changelogs.
- Correlate kernel warnings with workloads that perform heavy NUMA balancing, compaction, or transparent huge page (THP) migration.
Monitoring Recommendations
- Centralize kernel logs from Linux hosts and alert on WARN_ON or WARNING: strings originating from memory management functions.
- Track THP statistics in /proc/vmstat (thp_split_page, thp_deferred_split_page) for anomalous values that may indicate lost folios.
- Include kernel version inventory in vulnerability management to flag hosts running pre-patch builds.
How to Mitigate CVE-2026-46017
Immediate Actions Required
- Identify Linux hosts running kernels that include the deferred split migration logic but lack the upstream fixes.
- Apply distribution kernel updates that backport commits 3bac01168982ec3e3bf87efdc1807c7933590a85 and cbf75cf212ee6e499abc1757fb4b5ae6d70ed0aa.
- Reboot affected systems after patching to load the corrected kernel image.
Patch Information
The fix moves the deferred split queue requeue before remove_migration_ptes() so the destination folio is queued before it becomes visible. It also updates deferred_split_scan() to requeue folios when folio_trylock() fails, preventing silent loss from split_queue. Patches are available via the stable tree commit 3bac011689 and stable tree commit cbf75cf212.
Workarounds
- Disable or reduce reliance on transparent huge pages where workloads permit, lowering the frequency of deferred split queue operations.
- Limit memory migration triggers such as NUMA auto-balancing on hosts that cannot be patched immediately.
- Restrict untrusted local workloads on unpatched kernels to reduce concurrent memory pressure scenarios.
# Verify kernel version and check for the fix
uname -r
# Temporarily reduce THP usage to limit deferred split activity
echo madvise | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
# Disable NUMA balancing to reduce migration-driven races
sudo sysctl -w kernel.numa_balancing=0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
