Linux mm/vmscan: direct reclaim never reports an RCU-tasks quiescent state, stalling rcu_tasks under memory pressure

Impact

Nothing bounds how long direct reclaim runs, and the scan loop in shrink_lruvec() only called cond_resched(), which is a no-op on PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU quiescent state, so a task reclaiming inside a page fault never reports one and becomes an rcu_tasks holdout. The reporter observed these stalls in the Meta fleet, with the holdout task sitting in shrink_lruvec under handle_mm_fault. Tasks-RCU is what gates tracepoint and BPF trampoline teardown, so a stall there hangs observability and BPF-attached tooling on a node that is already under memory pressure - exactly the moment an operator is trying to see what is happening on a GPU host packed to its memory limit. The fix upgrades the call to cond_resched_tasks_rcu_qs(), which reports a quiescent state even when cond_resched() does nothing.

Who can reach it

No attacker required. Any workload that drives sustained direct reclaim on a PREEMPTION kernel reproduces it, including an ordinary tenant filling memory in their own cgroup.

What to do

Patch the host kernel to a stable release containing the cond_resched_tasks_rcu_qs() change and reboot the node. No configuration mitigates it; reducing memory pressure so direct reclaim is short-lived avoids the stall in practice. Watch for 'rcu_tasks detected stalls on tasks' in dmesg with shrink_lruvec in the call trace to identify affected nodes.

References

Related entries

• Linux kernel mm/migrate: long page-migration batches stall Tasks-RCU grace periods on KVM hostsCVE-2026-89756 · Linux kernel mm/migrate (migrate_pages_batch RCU-tasks quiescent state)Unscored
• Linux kernel DAMON: merge-threshold overflow can spin kdamond in an infinite in-kernel loopCVE-2026-89796 · Linux kernel mm/damon/core (kdamond_merge_regions threshold overflow)Unscored
• Linux qla2xxx: D_Port diagnostics copies uninitialized kernel heap bytes to user spaceCVE-2026-89859 · Linux kernel qla2xxx (D_Port diagnostics response buffer)Unscored
• KVM on s390: uninitialized stack bytes in injected pfault interrupt state readable via migration ioctlsCVE-2026-89921 · Linux kernel KVM/s390 (inject_pfault_token interrupt injection)Unscored
• Linux kernel dma-heap: failed copy_to_user leaks an already-installed dma-buf fd for process lifetimeCVE-2026-89996 · Linux kernel dma-buf dma-heap (DMA_HEAP_IOCTL_ALLOC)Unscored
• Linux kernel arm-smmu-v3: device teardown frees the IOPF queue before the IRQ handler that uses itCVE-2026-93205 · Linux kernel iommu/arm-smmu-v3 (teardown ordering in arm_smmu_device_remove)Unscored