CVE-2026-23097 (GCVE-0-2026-23097)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-06-11 18:44
VLAI
Title
migrate: correct lock ordering for hugetlb file folios
Summary
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock. migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() <- Takes folio_lock! -> remove_migration_ptes() -> __rmap_walk_file() -> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)! hugetlbfs_fallocate() -> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)! -> hugetlbfs_zero_partial_page() -> filemap_lock_hugetlb_folio() -> filemap_lock_folio() -> __filemap_get_folio <- Waits for folio_lock! The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too. This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:41 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < e7396d23f9d5739f56cf9ab430c3a169f5508394 (git)
Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < ad97b9a55246eb940a26ac977f80892a395cabf9 (git)
Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < 5edb9854f8df5428b40990a1c7d60507da5bd330 (git)
Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < 526394af4e8ade89cacd1a9ce2b97712712fcc34 (git)
Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < b75070823b89009f5123fd0e05a8e0c3d39937c1 (git)
Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < 1b68efce6dd483d22f50d0d3800c4cfda14b1305 (git)
Affected: 336bf30eb76580b579dc711ded5d599d905c0217 , < b7880cb166ab62c2409046b2347261abf701530e (git)
Affected: ef792d6ce0db6a56e56743b1de1716a982c3b851 (git)
Affected: 5.9.9 , < 5.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.249 , ≤ 5.10.* (semver)
Unaffected: 5.15.199 , ≤ 5.15.* (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.68 , ≤ 6.12.* (semver)
Unaffected: 6.18.8 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23097",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:33.152666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:13.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/migrate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7396d23f9d5739f56cf9ab430c3a169f5508394",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "lessThan": "ad97b9a55246eb940a26ac977f80892a395cabf9",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "lessThan": "5edb9854f8df5428b40990a1c7d60507da5bd330",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "lessThan": "526394af4e8ade89cacd1a9ce2b97712712fcc34",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "lessThan": "b75070823b89009f5123fd0e05a8e0c3d39937c1",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "lessThan": "1b68efce6dd483d22f50d0d3800c4cfda14b1305",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "lessThan": "b7880cb166ab62c2409046b2347261abf701530e",
              "status": "affected",
              "version": "336bf30eb76580b579dc711ded5d599d905c0217",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ef792d6ce0db6a56e56743b1de1716a982c3b851",
              "versionType": "git"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/migrate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmigrate: correct lock ordering for hugetlb file folios\n\nSyzbot has found a deadlock (analyzed by Lance Yang):\n\n1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).\n2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire\nfolio_lock.\n\nmigrate_pages()\n  -\u003e migrate_hugetlbs()\n    -\u003e unmap_and_move_huge_page()     \u003c- Takes folio_lock!\n      -\u003e remove_migration_ptes()\n        -\u003e __rmap_walk_file()\n          -\u003e i_mmap_lock_read()       \u003c- Waits for i_mmap_rwsem(read lock)!\n\nhugetlbfs_fallocate()\n  -\u003e hugetlbfs_punch_hole()           \u003c- Takes i_mmap_rwsem(write lock)!\n    -\u003e hugetlbfs_zero_partial_page()\n     -\u003e filemap_lock_hugetlb_folio()\n      -\u003e filemap_lock_folio()\n        -\u003e __filemap_get_folio        \u003c- Waits for folio_lock!\n\nThe migration path is the one taking locks in the wrong order according to\nthe documentation at the top of mm/rmap.c.  So expand the scope of the\nexisting i_mmap_lock to cover the calls to remove_migration_ptes() too.\n\nThis is (mostly) how it used to be after commit c0d0381ade79.  That was\nremoved by 336bf30eb765 for both file \u0026 anon hugetlb pages when it should\nonly have been removed for anon hugetlb pages."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:03:50.508Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7396d23f9d5739f56cf9ab430c3a169f5508394"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad97b9a55246eb940a26ac977f80892a395cabf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/5edb9854f8df5428b40990a1c7d60507da5bd330"
        },
        {
          "url": "https://git.kernel.org/stable/c/526394af4e8ade89cacd1a9ce2b97712712fcc34"
        },
        {
          "url": "https://git.kernel.org/stable/c/b75070823b89009f5123fd0e05a8e0c3d39937c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b68efce6dd483d22f50d0d3800c4cfda14b1305"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7880cb166ab62c2409046b2347261abf701530e"
        }
      ],
      "title": "migrate: correct lock ordering for hugetlb file folios",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23097",
    "datePublished": "2026-02-04T16:08:19.815Z",
    "dateReserved": "2026-01-13T15:37:45.964Z",
    "dateUpdated": "2026-06-11T18:44:13.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23097",
      "date": "2026-08-22",
      "epss": "0.00114",
      "percentile": "0.01753"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23097\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T17:16:20.570\",\"lastModified\":\"2026-06-17T10:20:52.990\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmigrate: correct lock ordering for hugetlb file folios\\n\\nSyzbot has found a deadlock (analyzed by Lance Yang):\\n\\n1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).\\n2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire\\nfolio_lock.\\n\\nmigrate_pages()\\n  -\u003e migrate_hugetlbs()\\n    -\u003e unmap_and_move_huge_page()     \u003c- Takes folio_lock!\\n      -\u003e remove_migration_ptes()\\n        -\u003e __rmap_walk_file()\\n          -\u003e i_mmap_lock_read()       \u003c- Waits for i_mmap_rwsem(read lock)!\\n\\nhugetlbfs_fallocate()\\n  -\u003e hugetlbfs_punch_hole()           \u003c- Takes i_mmap_rwsem(write lock)!\\n    -\u003e hugetlbfs_zero_partial_page()\\n     -\u003e filemap_lock_hugetlb_folio()\\n      -\u003e filemap_lock_folio()\\n        -\u003e __filemap_get_folio        \u003c- Waits for folio_lock!\\n\\nThe migration path is the one taking locks in the wrong order according to\\nthe documentation at the top of mm/rmap.c.  So expand the scope of the\\nexisting i_mmap_lock to cover the calls to remove_migration_ptes() too.\\n\\nThis is (mostly) how it used to be after commit c0d0381ade79.  That was\\nremoved by 336bf30eb765 for both file \u0026 anon hugetlb pages when it should\\nonly have been removed for anon hugetlb pages.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nmigrate: orden correcto de bloqueo para folios de archivo hugetlb\\n\\nSyzbot ha encontrado un interbloqueo (analizado por Lance Yang):\\n\\n1) Tarea (5749): Mantiene folio_lock, luego intenta adquirir i_mmap_rwsem (bloqueo de lectura).\\n2) Tarea (5754): Mantiene i_mmap_rwsem (bloqueo de escritura), luego intenta adquirir folio_lock.\\n\\nmigrate_pages()\\n  -\u0026gt; migrate_hugetlbs()\\n    -\u0026gt; unmap_and_move_huge_page()     \u0026lt;- \u00a1Toma folio_lock!\\n      -\u0026gt; remove_migration_ptes()\\n        -\u0026gt; __rmap_walk_file()\\n          -\u0026gt; i_mmap_lock_read()       \u0026lt;- \u00a1Espera por i_mmap_rwsem (bloqueo de lectura)!\\n\\nhugetlbfs_fallocate()\\n  -\u0026gt; hugetlbfs_punch_hole()           \u0026lt;- \u00a1Toma i_mmap_rwsem (bloqueo de escritura)!\\n    -\u0026gt; hugetlbfs_zero_partial_page()\\n     -\u0026gt; filemap_lock_hugetlb_folio()\\n      -\u0026gt; filemap_lock_folio()\\n        -\u0026gt; __filemap_get_folio        \u0026lt;- \u00a1Espera por folio_lock!\\n\\nLa ruta de migraci\u00f3n es la que toma los bloqueos en el orden incorrecto seg\u00fan la documentaci\u00f3n en la parte superior de mm/rmap.c. As\u00ed que expandir el alcance del i_mmap_lock existente para cubrir tambi\u00e9n las llamadas a remove_migration_ptes().\\n\\nEsto es (en su mayor\u00eda) como sol\u00eda ser despu\u00e9s del commit c0d0381ade79. Eso fue eliminado por 336bf30eb765 tanto para p\u00e1ginas hugetlb de archivo como an\u00f3nimas cuando solo deber\u00eda haber sido eliminado para p\u00e1ginas hugetlb an\u00f3nimas.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/migrate.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"e7396d23f9d5739f56cf9ab430c3a169f5508394\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"ad97b9a55246eb940a26ac977f80892a395cabf9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"5edb9854f8df5428b40990a1c7d60507da5bd330\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"526394af4e8ade89cacd1a9ce2b97712712fcc34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"b75070823b89009f5123fd0e05a8e0c3d39937c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"1b68efce6dd483d22f50d0d3800c4cfda14b1305\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"336bf30eb76580b579dc711ded5d599d905c0217\",\"lessThan\":\"b7880cb166ab62c2409046b2347261abf701530e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef792d6ce0db6a56e56743b1de1716a982c3b851\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.9.9\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/migrate.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.249\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.199\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.122\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.68\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.8\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:41:33.152666Z\",\"id\":\"CVE-2026-23097\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9.9\",\"versionEndExcluding\":\"5.10\",\"matchCriteriaId\":\"9598C575-CE16-4F2B-A517-667AA54B4B86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.1\",\"versionEndExcluding\":\"5.10.249\",\"matchCriteriaId\":\"FE8CC3D1-1602-4F1D-A05B-F0E1722A86DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.199\",\"matchCriteriaId\":\"A247FBA6-BEB9-484F-B892-DD5517949CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"6579E0D4-0641-479D-A4C3-0EF618798C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.122\",\"matchCriteriaId\":\"8EAAE395-0162-4BAF-9AD5-E9AF3C869C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.68\",\"matchCriteriaId\":\"52F38E19-0FDD-4992-9D6D-D4169D689598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.8\",\"matchCriteriaId\":\"E65C6E79-7EBE-4C77-93F0-818CF5B38F4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B29EBB93-107F-4ED6-8DE3-C2732BC659C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CD159FA-170F-4389-9085-CACCF97ABB1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0390D83-6C17-4557-BE8D-B659E04F565A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4120E4B3-B66D-4ACE-8570-1DD4DF20A324\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"73D60343-647D-4B5D-AA6D-CE87C462E368\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b68efce6dd483d22f50d0d3800c4cfda14b1305\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/526394af4e8ade89cacd1a9ce2b97712712fcc34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5edb9854f8df5428b40990a1c7d60507da5bd330\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad97b9a55246eb940a26ac977f80892a395cabf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b75070823b89009f5123fd0e05a8e0c3d39937c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7880cb166ab62c2409046b2347261abf701530e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7396d23f9d5739f56cf9ab430c3a169f5508394\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:18:42+00:00",
      "cve": "CVE-2026-23097",
      "id": "CVE-2026-23097",
      "initial_release_date": "2026-02-04T00:00:00+00:00",
      "product_status:fixed": "2286",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23097.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23097\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:33.152666Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:28.787Z\"}}], \"cna\": {\"title\": \"migrate: correct lock ordering for hugetlb file folios\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"e7396d23f9d5739f56cf9ab430c3a169f5508394\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"ad97b9a55246eb940a26ac977f80892a395cabf9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"5edb9854f8df5428b40990a1c7d60507da5bd330\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"526394af4e8ade89cacd1a9ce2b97712712fcc34\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"b75070823b89009f5123fd0e05a8e0c3d39937c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"1b68efce6dd483d22f50d0d3800c4cfda14b1305\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"336bf30eb76580b579dc711ded5d599d905c0217\", \"lessThan\": \"b7880cb166ab62c2409046b2347261abf701530e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef792d6ce0db6a56e56743b1de1716a982c3b851\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.9.9\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/migrate.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.249\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.199\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.68\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/migrate.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e7396d23f9d5739f56cf9ab430c3a169f5508394\"}, {\"url\": \"https://git.kernel.org/stable/c/ad97b9a55246eb940a26ac977f80892a395cabf9\"}, {\"url\": \"https://git.kernel.org/stable/c/5edb9854f8df5428b40990a1c7d60507da5bd330\"}, {\"url\": \"https://git.kernel.org/stable/c/526394af4e8ade89cacd1a9ce2b97712712fcc34\"}, {\"url\": \"https://git.kernel.org/stable/c/b75070823b89009f5123fd0e05a8e0c3d39937c1\"}, {\"url\": \"https://git.kernel.org/stable/c/1b68efce6dd483d22f50d0d3800c4cfda14b1305\"}, {\"url\": \"https://git.kernel.org/stable/c/b7880cb166ab62c2409046b2347261abf701530e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmigrate: correct lock ordering for hugetlb file folios\\n\\nSyzbot has found a deadlock (analyzed by Lance Yang):\\n\\n1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).\\n2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire\\nfolio_lock.\\n\\nmigrate_pages()\\n  -\u003e migrate_hugetlbs()\\n    -\u003e unmap_and_move_huge_page()     \u003c- Takes folio_lock!\\n      -\u003e remove_migration_ptes()\\n        -\u003e __rmap_walk_file()\\n          -\u003e i_mmap_lock_read()       \u003c- Waits for i_mmap_rwsem(read lock)!\\n\\nhugetlbfs_fallocate()\\n  -\u003e hugetlbfs_punch_hole()           \u003c- Takes i_mmap_rwsem(write lock)!\\n    -\u003e hugetlbfs_zero_partial_page()\\n     -\u003e filemap_lock_hugetlb_folio()\\n      -\u003e filemap_lock_folio()\\n        -\u003e __filemap_get_folio        \u003c- Waits for folio_lock!\\n\\nThe migration path is the one taking locks in the wrong order according to\\nthe documentation at the top of mm/rmap.c.  So expand the scope of the\\nexisting i_mmap_lock to cover the calls to remove_migration_ptes() too.\\n\\nThis is (mostly) how it used to be after commit c0d0381ade79.  That was\\nremoved by 336bf30eb765 for both file \u0026 anon hugetlb pages when it should\\nonly have been removed for anon hugetlb pages.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.249\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.199\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.162\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.122\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.68\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.8\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.9.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T16:03:50.508Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23097\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:13.608Z\", \"dateReserved\": \"2026-01-13T15:37:45.964Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-04T16:08:19.815Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.