Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lru

Impact

__folio_split() left the xa_state's xa_lru unset, so xas_try_split() could allocate a page-cache xa_node with __GFP_ACCOUNT - charged to a memcg - that was never linked into the mapping's shadow_nodes list_lru. Reclaim walking that list_lru later trips VM_WARN_ON(!css_is_dying()); on a fleet built with panic_on_warn that is a node down, and even without it the node is a memcg-charged allocation reclaim cannot find, so cgroup memory accounting drifts on a long-running host. The trigger is ordinary behaviour, not a crafted attack: any workload doing large page-cache-backed file I/O inside a cgroup with THP enabled, which describes dataset staging from local NVMe on essentially every GPU node. The fix uses mapping_set_update() to install both the workingset update callback and the list_lru on the xa_state. The record carries no CVSS score and no CWE.

Who can reach it

Local: any workload in a memory cgroup that generates page-cache folio splits under THP - no privileges and no special capability beyond running a pod on the node. Not remotely reachable.

What to do

Apply the stable kernel update carrying d858f7c9fc51 (or aca1f2d5de17 for the other branch), then drain and reboot each node - this is core mm, so there is no userspace-side mitigation. If you cannot patch soon, the practical stopgaps are disabling THP for the affected workloads and not running panic_on_warn on nodes you cannot afford to lose.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical