Linux kernel mm/migrate: long page-migration batches stall Tasks-RCU grace periods on KVM hosts

Impact

On a KVM host, unmapping a large batch of folios in migrate_pages_batch() runs mmu_notifier callbacks that reach tdp_mmu_zap_leafs(), which is expensive. On PREEMPTION kernels cond_resched() is a no-op and involuntary preemption is not a Tasks-RCU quiescent state, so the migrating task (typically kcompactd) becomes a Tasks-RCU holdout and stalls the grace period for minutes. The report comes from a large production fleet. For a GPU node this is an availability problem, not a privilege one: a host running VM tenants with compaction active can hang Tasks-RCU consumers and produce rcu_tasks stall splats, and no attacker action is required.

Who can reach it

No attacker needed; triggered by normal memory compaction on a KVM host with PREEMPTION enabled. Local workload pressure makes it more likely.

What to do

Pick up the stable kernel commits that switch migrate_pages_batch() to cond_resched_tasks_rcu_qs(). Applying it means installing a patched kernel and rebooting each host, so it rides an existing node-drain and reboot window rather than justifying its own.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical