Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lru

Impact

__folio_split() left the xa_state's xa_lru unset, so xas_try_split() could allocate a page-cache xa_node with __GFP_ACCOUNT - charged to a memcg - that was never linked into the mapping's shadow_nodes list_lru. Reclaim walking that list_lru later trips VM_WARN_ON(!css_is_dying()); on a fleet built with panic_on_warn that is a node down, and even without it the node is a memcg-charged allocation reclaim cannot find, so cgroup memory accounting drifts on a long-running host. The trigger is ordinary behaviour, not a crafted attack: any workload doing large page-cache-backed file I/O inside a cgroup with THP enabled, which describes dataset staging from local NVMe on essentially every GPU node. The fix uses mapping_set_update() to install both the workingset update callback and the list_lru on the xa_state. The record carries no CVSS score and no CWE.

Who can reach it

Local: any workload in a memory cgroup that generates page-cache folio splits under THP - no privileges and no special capability beyond running a pod on the node. Not remotely reachable.

What to do

Apply the stable kernel update carrying d858f7c9fc51 (or aca1f2d5de17 for the other branch), then drain and reboot each node - this is core mm, so there is no userspace-side mitigation. If you cannot patch soon, the practical stopgaps are disabling THP for the affected workloads and not running panic_on_warn on nodes you cannot afford to lose.

References

Related entries

• Linux nvmet-tcp: remote initiator can trip a kernel WARN via an oversized SGL, killing panic-on-warn hostsCVE-2026-80788 · Linux kernel nvmet-tcp (NVMe-over-TCP target SGL allocation)Unscored
• Linux kernel nvmet-tcp: unbounded kernel allocation from an unauthenticated NVMe/TCP peerCVE-2026-80789 · Linux kernel nvmet-tcp (NVMe/TCP target SGL length validation)Unscored
• Linux kernel nvmet-auth: uninitialized slab sent to a remote initiator during NVMe-oF authenticationCVE-2026-80791 · Linux kernel nvmet-auth (DH-HMAC-CHAP AUTH_RECEIVE response buffer)Unscored
• Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernelsCVE-2026-80810 · Linux kernel io_uring/rsrc (registered-buffer folio shift in io_vec_fill_bvec)Unscored
• Linux kernel io_uring uring_cmd: iovec leak under NVMe passthrough once the alloc cache fillsCVE-2026-80811 · Linux kernel io_uring uring_cmd (async command iovec lifetime)Unscored
• Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF targetCVE-2026-80813 · Linux kernel nvmet (Identify CNS 07h active namespace list handler)Unscored