CVE-2026-64129: Linux Kernel Spinlock Leak DoS Vulnerability

CVE-2026-64129 Overview

CVE-2026-64129 is a Linux kernel vulnerability in the memory migration subsystem. The flaw resides in migrate_vma_insert_huge_pmd_page within mm/migrate_device. When check_stable_address_space() fails after the Page Middle Directory (PMD) spinlock has been acquired through pmd_lock(), control transfers to the abort label. This code path bypasses the spin_unlock() call in unlock_abort, leaving the PMD spinlock permanently held. The stuck spinlock produces a deadlock in the memory migration path.

Critical Impact
Local processes triggering the affected memory migration path can deadlock the PMD spinlock, blocking further memory operations and causing kernel-level denial of service.

Affected Products

Linux kernel versions containing the migrate_vma_insert_huge_pmd_page function in mm/migrate_device
Distributions shipping the affected kernel commits prior to the referenced stable fixes
Systems using device memory migration with transparent huge pages

Discovery Timeline

2026-07-19 - CVE-2026-64129 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64129

Vulnerability Analysis

The defect is a control-flow error in Linux kernel memory management. The function migrate_vma_insert_huge_pmd_page acquires the PMD spinlock via pmd_lock() before validating the target address space. When check_stable_address_space() returns a failure, the original code uses goto abort instead of goto unlock_abort. The abort label skips the spin_unlock() call that releases the PMD spinlock. Any subsequent kernel path attempting to acquire the same PMD lock blocks indefinitely. This produces a deadlock affecting memory management operations on the impacted virtual memory area.

Root Cause

The root cause is an incorrect goto target on an error path. The fix redirects the branch from abort to unlock_abort so that the spinlock release always executes when check_stable_address_space() fails. This is a resource-leak class defect [CWE-667] where lock ownership is retained after an error exit.

Attack Vector

The vulnerability is reachable through workloads that invoke device memory migration for transparent huge pages, such as heterogeneous memory management (HMM) or GPU driver-triggered migrations. A local process able to trigger migrate_vma_insert_huge_pmd_page with an address space state that fails the stability check can force the deadlock. No remote attack vector is described. The condition results in a kernel denial of service rather than code execution or privilege escalation.

No verified public exploit code is available. See the upstream fixes at Kernel commit 63451de1 and Kernel commit c715f7cc for the corrected control flow.

Detection Methods for CVE-2026-64129

Indicators of Compromise

Kernel soft-lockup or hung-task warnings referencing migrate_vma_insert_huge_pmd_page or pmd_lock in dmesg output
Processes stuck in D (uninterruptible sleep) state waiting on PMD spinlocks during device memory migration
Lockdep splats or INFO: task blocked for more than N seconds messages tied to memory migration workloads

Detection Strategies

Enable CONFIG_LOCKDEP and CONFIG_DEBUG_SPINLOCK on test kernels to surface unreleased spinlocks in the migration path
Correlate kernel ring buffer entries mentioning migrate_device or check_stable_address_space with hung-task detection thresholds
Compare running kernel versions and vendor backports against the fixed commits referenced in the upstream stable tree

Monitoring Recommendations

Collect dmesg, /proc/lockdep, and sysrq-t output from Linux hosts running GPU or accelerator workloads that exercise HMM device migration
Ingest kernel logs into a centralized log platform and alert on repeated hung-task or spinlock warnings tied to mm/migrate_device
Track kernel package versions across the fleet to identify hosts still exposed to the pre-patch code path

How to Mitigate CVE-2026-64129

Immediate Actions Required

Inventory Linux hosts running kernels that include migrate_vma_insert_huge_pmd_page in mm/migrate_device
Apply the vendor-supplied kernel update containing the corrected goto unlock_abort control flow
Reboot affected systems after installation to activate the patched kernel image

Patch Information

The upstream fix changes the goto abort on the failing check_stable_address_space() path to goto unlock_abort, ensuring the PMD spinlock is released. The patch is available in the Linux stable tree at Kernel commit 63451de1 and Kernel commit c715f7cc. Distribution maintainers backport these commits into supported kernel branches.

Workarounds

Restrict workloads that trigger device memory migration with transparent huge pages until the patched kernel is deployed
Disable transparent huge pages on affected hosts where feasible by setting transparent_hugepage=never at boot to reduce exposure of the huge-PMD migration path
Limit local user access on multi-tenant systems to reduce the population of accounts able to invoke the affected code path

bash

# Verify running kernel version and confirm patch presence
uname -r
rpm -q kernel || dpkg -l | grep linux-image
# Optional: reduce exposure by disabling transparent huge pages at runtime
echo never > /sys/kernel/mm/transparent_hugepage/enabled