CVE-2026-80719 Overview
CVE-2026-80719 is a race condition in the Linux kernel's Multi-Generational LRU (MGLRU) memory management subsystem. The flaw occurs between the MGLRU page table walker and the memory cgroup (memcg) reparenting path. The page table walker batches per-generation size deltas in walk->nr_pages without holding the lruvec lock, allowing a concurrent mem_cgroup_css_offline to reparent child folios before the deltas are folded back. This produces stale nr_pages accounting on the offlined lruvec.
Critical Impact
Underestimated nr_pages in MGLRU causes premature out-of-memory (OOM) kills because MGLRU stops reclaiming when nr_pages reaches zero even when reclaimable pages remain.
Affected Products
- Linux kernel versions containing the MGLRU page table walker with memcg reparenting support
- Stable kernel branches receiving the referenced backports
- Distributions shipping affected upstream kernels
Discovery Timeline
- 2026-08-28 - CVE-2026-80719 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80719
Vulnerability Analysis
The defect lives in the MGLRU page table walker. During walk_mm → walk_page_range → update_batch_size, the walker accumulates page count deltas in walk->nr_pages without holding the lruvec lock. The counter is later flushed by reset_batch_size() under the lruvec lock. This design assumes the target lruvec remains stable between accumulation and flush.
On a second CPU, mem_cgroup_css_offline can call memcg_reparent_objcgs, which takes the lruvec lock and invokes lru_gen_reparent_memcg to move child folios to the parent memcg. When the walker later acquires the lock and runs reset_batch_size, it adds its pending delta to the now-empty child lrugen->nr_pages. This triggers VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0, ...)) in lru_gen_exit_memcg() and desynchronizes generation accounting.
Root Cause
The root cause is a race condition between unlocked delta batching in the MGLRU walker and locked reparenting in the memcg offline path. The walker does not re-validate whether the target memcg is dying before folding deltas, so accounting can be applied to a reparented lruvec.
Attack Vector
Triggering the race requires concurrent memory pressure driving MGLRU page table walks alongside cgroup lifecycle churn that offlines memcgs. This is a local kernel condition rather than a remote vector. The observable outcome is premature OOM kills and kernel warnings, not memory corruption or code execution. See the upstream fix commit and the companion stable backport for the exact code paths.
No public proof-of-concept exists. The vulnerability manifests under production workloads that combine MGLRU reclaim with frequent container or cgroup teardown.
Detection Methods for CVE-2026-80719
Indicators of Compromise
- Kernel warnings from lru_gen_exit_memcg() matching VM_WARN_ON_ONCE on lruvec->lrugen.nr_pages
- Unexpected OOM kills on hosts with substantial free reclaimable memory
- Anomalous MGLRU generation counters visible in /sys/kernel/debug/lru_gen
Detection Strategies
- Monitor dmesg and journal logs for MGLRU-related VM_WARN_ON_ONCE stack traces referencing lru_gen_exit_memcg
- Correlate OOM events with cgroup offline activity to identify the race pattern
- Track kernel version and patch state across the fleet to identify unpatched hosts
Monitoring Recommendations
- Ingest kernel logs into a centralized log platform and alert on MGLRU warning signatures
- Baseline OOM kill rates per host and flag deviations that coincide with heavy container churn
- Review /proc/pressure/memory PSI metrics for reclaim stalls that precede premature OOMs
How to Mitigate CVE-2026-80719
Immediate Actions Required
- Apply the upstream kernel patches referenced in the CVE to all affected hosts
- Prioritize patching on systems running MGLRU with heavy cgroup lifecycle activity such as container platforms
- Reboot patched systems to load the fixed kernel
Patch Information
The fix modifies reset_batch_size() to check CSS_DYING under RCU before flushing the pending batch. A non-dying memcg keeps the original lruvec stable against RCU-delayed offlining. A dying memcg redirects the deltas to the first non-dying ancestor. The changes are available in the primary fix commit and the stable branch backport.
Workarounds
- Disable MGLRU by writing n to /sys/kernel/mm/lru_gen/enabled if the patch cannot be applied immediately
- Reduce cgroup churn by limiting container restart frequency on affected hosts
- Increase memory headroom to reduce reclaim pressure that exercises the racing code path
# Check MGLRU status and disable if patch is not yet applied
cat /sys/kernel/mm/lru_gen/enabled
echo n | sudo tee /sys/kernel/mm/lru_gen/enabled
# Verify running kernel version against patched build
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
