CVE-2026-89986

Status: UPDATED  |  Advisory ID: CVE-2026-89986

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()

syzbot reported a sleeping function called from invalid context splat in

bucket_table_alloc().

When rhashtable_insert_slow() rehashes the table under rcu_read_lock(), it

calls bucket_table_alloc(..., GFP_ATOMIC | __GFP_NOWARN). If the bucket

table allocation uses vmalloc, __vmalloc_node_range_noprof() invokes

vm_area_alloc_pages() -> alloc_pages_bulk_mempolicy_noprof() with the

passed GFP_ATOMIC flags.

If the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy,

alloc_pages_bulk_weighted_interleave() is called and currently hardcodes

GFP_KERNEL when allocating the temporary weights array, triggering a

might_alloc() splat in atomic/RCU contexts.

Pass the gfp flags (masked with GFP_RECLAIM_MASK to strip page-allocator

zone modifiers like __GFP_HIGHMEM) received by

alloc_pages_bulk_weighted_interleave() to kmalloc() instead of hardcoding

GFP_KERNEL. Since the weights buffer is immediately initialized in full,

kmalloc() is sufficient. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References