CVE-2026-80719

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80719", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.788Z", "datePublished": "2026-08-28T06:53:16.087Z", "dateUpdated": "2026-08-28T06:53:16.087Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-28T06:53:16.087Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: mglru: fix stale batch updates after memcg reparenting\n\nThe mglru page table walker batches per-generation size deltas in\nwalk->nr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk->lruvec under\nthe lruvec lock.\n\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\n\nCPU0 CPU1\n==== ====\n\nwalk_mm\n--> walk_page_range\n --> update_batch_size\n --> walk->nr_pages += delta\n\n mem_cgroup_css_offline\n --> memcg_reparent_objcgs\n --> lock lruvec\n lru_gen_reparent_memcg\n --> reparent child folios to parent\n unlock lruvec\n\n lock lruvec\n reset_batch_size\n --> child lrugen->nr_pages += delta\n\nThis will trigger the following warning in lru_gen_exit_memcg():\n\n\tVM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,\n\t\t\t\t sizeof(lruvec->lrugen.nr_pages)));\n\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\n\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch. A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/memcontrol.h", "mm/vmscan.c"], "versions": [{"version": "f304652609eae3814b0e9d11c75c0e0cb62da31f", "lessThan": "fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101", "status": "affected", "versionType": "git"}, {"version": "f304652609eae3814b0e9d11c75c0e0cb62da31f", "lessThan": "de4660898b7aa7e03d3b120a6bfa6b26211e4e77", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/memcontrol.h", "mm/vmscan.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"}, {"url": "https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77"}], "title": "mm: mglru: fix stale batch updates after memcg reparenting", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/memcontrol.h", "mm/vmscan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101", "status": "affected", "version": "f304652609eae3814b0e9d11c75c0e0cb62da31f", "versionType": "git"}, {"lessThan": "de4660898b7aa7e03d3b120a6bfa6b26211e4e77", "status": "affected", "version": "f304652609eae3814b0e9d11c75c0e0cb62da31f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/memcontrol.h", "mm/vmscan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: mglru: fix stale batch updates after memcg reparenting\n\nThe mglru page table walker batches per-generation size deltas in\nwalk->nr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk->lruvec under\nthe lruvec lock.\n\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\n\nCPU0 CPU1\n==== ====\n\nwalk_mm\n--> walk_page_range\n --> update_batch_size\n --> walk->nr_pages += delta\n\n mem_cgroup_css_offline\n --> memcg_reparent_objcgs\n --> lock lruvec\n lru_gen_reparent_memcg\n --> reparent child folios to parent\n unlock lruvec\n\n lock lruvec\n reset_batch_size\n --> child lrugen->nr_pages += delta\n\nThis will trigger the following warning in lru_gen_exit_memcg():\n\n\tVM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,\n\t\t\t\t sizeof(lruvec->lrugen.nr_pages)));\n\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\n\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch. A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor."}], "id": "CVE-2026-80719", "lastModified": "2026-08-28T08:16:57.720", "metrics": {}, "published": "2026-08-28T08:16:57.720", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mm: mglru: fix stale batch updates after memcg reparenting", "id": "2525450", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525450"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: mglru: fix stale batch updates after memcg reparenting\nThe mglru page table walker batches per-generation size deltas in\nwalk->nr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk->lruvec under\nthe lruvec lock.\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\nCPU0 CPU1\n==== ====\nwalk_mm\n--> walk_page_range\n--> update_batch_size\n--> walk->nr_pages += delta\nmem_cgroup_css_offline\n--> memcg_reparent_objcgs\n--> lock lruvec\nlru_gen_reparent_memcg\n--> reparent child folios to parent\nunlock lruvec\nlock lruvec\nreset_batch_size\n--> child lrugen->nr_pages += delta\nThis will trigger the following warning in lru_gen_exit_memcg():\nVM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,\nsizeof(lruvec->lrugen.nr_pages)));\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch. A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor.", "A flaw was found in the Linux kernel's Multi-Generational Least Recently Used (MGLRU) page table walker. When memory cgroup (memcg) reparenting occurs concurrently with page table walks, stale batch updates can lead to an underestimation of the number of pages. This can prevent the kernel from reclaiming memory effectively, potentially causing premature Out Of Memory (OOM) conditions and system instability."], "name": "CVE-2026-80719", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80719\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80719\nhttps://lore.kernel.org/linux-cve-announce/2026082810-CVE-2026-80719-1e50@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f304652609eae3814b0e9d11c75c0e0cb62da31f,fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f304652609eae3814b0e9d11c75c0e0cb62da31f,de4660898b7aa7e03d3b120a6bfa6b26211e4e77)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "kernel", "vendor": "linux"}], "created": "2026-08-28T11:00:11.889320+00:00", "updated": "2026-09-02T08:00:14.112691+00:00", "vendors": ["linux", "linux$PRODUCT$kernel"]}