PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46017 Linux CVE debrief

A race condition in the Linux kernel's memory management (mm) subsystem could allow a concurrent rmap-removal path to mark a destination folio as partially mapped, triggering a WARN in deferred_split_folio(). The vulnerability occurs in migrate_folio_move() where the deferred split queue state is replayed on the destination folio after remove_migration_ptes() makes it visible. A concurrent operation could then mark the folio partially mapped before it is requeued. Additionally, without proper locking, a fully mapped underused folio could be silently lost from the split_queue by the shrinker. The fix moves the requeue operation before remove_migration_ptes() and teaches deferred_split_scan() to requeue a folio when folio_trylock() fails.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with transparent hugepage support or workloads involving memory migration; kernel developers and distribution maintainers responsible for stable kernel updates

Technical summary

The Linux kernel's migrate_folio_move() function recorded deferred split queue state from a source folio and replayed it on a destination folio after remove_migration_ptes(src, dst, 0) was called. This ordering created a window where the destination folio was visible before being requeued, allowing a concurrent rmap-removal path to mark it partially mapped and trigger a WARN in deferred_split_folio(). The fix reorders operations to requeue the destination folio before it becomes visible again. Additionally, deferred_split_scan() was modified to requeue a folio when folio_trylock() fails, preventing fully mapped underused folios from being silently lost from the split_queue by the shrinker during migration.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from the stable kernel git repository when available for your distribution
  • Monitor vendor security advisories for kernel updates addressing this issue
  • Review systems running workloads with heavy memory migration or transparent hugepage usage for stability concerns
  • Consider enabling kernel lockdep or other debugging facilities if stability issues are suspected in memory management paths

Evidence notes

The vulnerability description is derived from the official CVE record and NVD source data. The technical details regarding migrate_folio_move(), deferred_split_folio(), and the race condition are taken directly from the CVE description. The fix involves reordering operations and adding lock handling in deferred_split_scan().

Official resources

2026-05-27