Linux kernel mm/mempolicy: weighted-interleave bulk allocation sleeps in atomic context

Impact

alloc_pages_bulk_weighted_interleave() hardcoded GFP_KERNEL for its temporary weights array instead of honouring the caller's flags. A task with an MPOL_WEIGHTED_INTERLEAVE mempolicy that triggers a vmalloc-backed GFP_ATOMIC allocation - syzbot hit it through rhashtable_insert_slow() rehashing under rcu_read_lock() - performs a sleeping allocation in atomic/RCU context. The result is a might_alloc() splat and potential deadlock or crash, so this is an availability problem on the host. It is worth knowing about on NUMA-heavy GPU and CXL-tiered nodes, where weighted interleave is exactly the policy operators set to spread memory bandwidth across nodes, and where the affected task can be an ordinary unprivileged tenant process that set its own mempolicy. No privilege escalation or data disclosure is described.

Who can reach it

Local unprivileged process that sets MPOL_WEIGHTED_INTERLEAVE and drives kernel allocations reaching the bulk allocator from atomic context. No authentication beyond a local process; no remote path.

What to do

Move to a stable kernel that passes the caller's gfp flags through (four stable commits referenced) and reboot the affected nodes, draining GPU workloads first. No fixed release number is stated. Mitigation short of patching: avoid MPOL_WEIGHTED_INTERLEAVE for untrusted workloads, since the path is only reachable under that policy.

References

Related entries

• Linux kernel megaraid_sas: NVMe PRP list overruns the chain frame and corrupts other in-flight commandsCVE-2026-90008 · Linux kernel megaraid_sas (NVMe PRP chain frame)High
• Linux kernel SCSI bsg: TOCTOU on the shared io_uring SQE overflows the SCSI command bufferCVE-2026-90009 · Linux kernel SCSI bsg (io_uring passthrough command setup)High
• Linux kernel bsg: sense data copy ignores max_response_len and overruns the user bufferCVE-2026-90010 · Linux kernel SCSI bsg (io_uring sense copy)High
• Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor buildsCVE-2026-90046 · Linux kernel mm/page_alloc (free_pages_nolock in NMI on UP builds)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High