CVE-2026-89756 Overview
CVE-2026-89756 is a Linux kernel denial-of-service condition in the memory migration subsystem. The flaw resides in migrate_pages_batch(), which unmaps each folio before moving it and triggers mmu_notifier invalidate callbacks on every unmap. On KVM hosts, these callbacks invoke tdp_mmu_zap_leafs(), a computationally expensive routine that keeps the CPU busy for extended periods. The loop calls cond_resched(), but on PREEMPTION kernels this becomes a no-op and involuntary preemption does not qualify as a Tasks-RCU quiescent state. Long batches never report a quiescent state, causing the migrating task such as kcompactd to become a Tasks-RCU holdout and stall the Tasks-RCU grace period for minutes.
Critical Impact
Kernel tasks performing page migration on KVM hosts can stall Tasks-RCU grace periods for minutes, blocking dependent kernel operations and degrading host and guest performance.
Affected Products
- Linux kernel versions containing the migrate_pages_batch() implementation without RCU-tasks quiescent state reporting
- KVM host systems using the TDP MMU
- Systems running kernel compaction workloads (kcompactd) with PREEMPTION enabled
Discovery Timeline
- 2026-09-11 - CVE CVE-2026-89756 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89756
Vulnerability Analysis
The defect is a Tasks-RCU stall triggered by long-running page migration batches. migrate_pages_batch() iterates over folios, calling try_to_migrate() which invokes MMU notifier invalidation callbacks. On KVM hosts, the callback chain reaches kvm_mmu_notifier_invalidate_range_start() and tdp_mmu_zap_leafs(), which walks and tears down TDP MMU page tables. Large batches keep the CPU on this path for extended intervals.
The loop relies on cond_resched() to yield the CPU. On kernels built with CONFIG_PREEMPTION, cond_resched() is a no-op because preemption already handles scheduling. However, involuntary preemption does not register as a Tasks-RCU quiescent state. As a result, the migrating task never signals a quiescent state and blocks any Tasks-RCU grace period from completing.
Meta's fleet observed stalls affecting kcompactd, with rcu_tasks reporting holdouts and Tasks-RCU grace periods stretched to minutes. This delays subsystems that depend on Tasks-RCU synchronization such as tracing and ftrace trampoline teardown.
Root Cause
The root cause is missing explicit Tasks-RCU quiescent state reporting inside a long-running kernel loop. cond_resched() alone does not report a Tasks-RCU quiescent state on PREEMPTION kernels, so tasks executing expensive MMU notifier callbacks remain Tasks-RCU holdouts indefinitely.
Attack Vector
The issue is triggered by normal kernel operation on KVM hosts under memory pressure. No authenticated attacker action is required; the stall occurs when compaction or migration processes large batches of folios while KVM guests are active. The impact is resource exhaustion and degraded host responsiveness rather than memory corruption or privilege escalation. See the kernel commit fix for the applied change.
The fix replaces cond_resched() with cond_resched_tasks_rcu_qs() inside migrate_pages_batch(), which reports a Tasks-RCU quiescent state even when the underlying reschedule call performs no action.
Detection Methods for CVE-2026-89756
Indicators of Compromise
- Kernel log entries containing INFO: rcu_tasks detected stalls on tasks with kcompactd or other migration tasks listed as holdouts
- Call traces showing tdp_mmu_zap_leafs, kvm_mmu_notifier_invalidate_range_start, try_to_migrate, and migrate_pages_batch in the stack
- Extended Tasks-RCU grace periods visible in /sys/kernel/debug/rcu counters
Detection Strategies
- Parse dmesg and journald output for rcu_tasks stall warnings correlated with high memory compaction activity
- Monitor kcompactd CPU state transitions and long-running R (running) states on KVM hosts
- Track KVM host telemetry for spikes in MMU notifier invalidation latency alongside guest memory ballooning or migration events
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on rcu_tasks detected stalls patterns
- Baseline compaction and migration frequency on KVM hosts to identify anomalous sustained activity
- Correlate host stall events with guest performance regressions to prioritize patching
How to Mitigate CVE-2026-89756
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the NVD entry to all affected Linux hosts, prioritizing KVM hypervisors
- Inventory kernel versions across the fleet and identify hosts running vulnerable builds with CONFIG_PREEMPTION enabled
- Coordinate reboots for hypervisor hosts using live migration to minimize guest disruption
Patch Information
The fix is delivered across multiple stable branches. Apply the patch corresponding to your kernel series from the following commits: 4757542, 4996a7b, 5dc0daf, 6673498, 8c6d63d, and efe8f86. The change swaps cond_resched() for cond_resched_tasks_rcu_qs() inside the migration loop.
Workarounds
- Reduce compaction pressure on KVM hosts by tuning vm.compaction_proactiveness downward until patches are deployed
- Lower the frequency of large-scale page migrations by adjusting NUMA balancing parameters where safe for the workload
- Where feasible, run non-PREEMPTION kernels on affected hosts as an interim measure, since cond_resched() behavior differs on non-preemptible builds
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.