Linux kernel mm/migrate: long page-migration batches stall Tasks-RCU grace periods on KVM hosts

Impact

On a KVM host, unmapping a large batch of folios in migrate_pages_batch() runs mmu_notifier callbacks that reach tdp_mmu_zap_leafs(), which is expensive. On PREEMPTION kernels cond_resched() is a no-op and involuntary preemption is not a Tasks-RCU quiescent state, so the migrating task (typically kcompactd) becomes a Tasks-RCU holdout and stalls the grace period for minutes. The report comes from a large production fleet. For a GPU node this is an availability problem, not a privilege one: a host running VM tenants with compaction active can hang Tasks-RCU consumers and produce rcu_tasks stall splats, and no attacker action is required.

Who can reach it

No attacker needed; triggered by normal memory compaction on a KVM host with PREEMPTION enabled. Local workload pressure makes it more likely.

What to do

Pick up the stable kernel commits that switch migrate_pages_batch() to cond_resched_tasks_rcu_qs(). Applying it means installing a patched kernel and rebooting each host, so it rides an existing node-drain and reboot window rather than justifying its own.

References

Related entries

• Linux kernel DAMON: merge-threshold overflow can spin kdamond in an infinite in-kernel loopCVE-2026-89796 · Linux kernel mm/damon/core (kdamond_merge_regions threshold overflow)Unscored
• Linux qla2xxx: D_Port diagnostics copies uninitialized kernel heap bytes to user spaceCVE-2026-89859 · Linux kernel qla2xxx (D_Port diagnostics response buffer)Unscored
• KVM on s390: uninitialized stack bytes in injected pfault interrupt state readable via migration ioctlsCVE-2026-89921 · Linux kernel KVM/s390 (inject_pfault_token interrupt injection)Unscored
• Linux kernel dma-heap: failed copy_to_user leaks an already-installed dma-buf fd for process lifetimeCVE-2026-89996 · Linux kernel dma-buf dma-heap (DMA_HEAP_IOCTL_ALLOC)Unscored
• Linux kernel arm-smmu-v3: device teardown frees the IOPF queue before the IRQ handler that uses itCVE-2026-93205 · Linux kernel iommu/arm-smmu-v3 (teardown ordering in arm_smmu_device_remove)Unscored
• Linux kernel PCI/proc: config space read checked against the reader's credentials, not the opener'sCVE-2026-93206 · Linux kernel PCI procfs interface (proc_bus_pci_read CAP_SYS_ADMIN check)Unscored