Deadlock in Linux Kernel Hugetlb File Migration due to Lock Ordering
CVE-2026-23097 Published on February 4, 2026
migrate: correct lock ordering for hugetlb file folios
In the Linux kernel, the following vulnerability has been resolved:
migrate: correct lock ordering for hugetlb file folios
Syzbot has found a deadlock (analyzed by Lance Yang):
1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).
2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire
folio_lock.
migrate_pages()
-> migrate_hugetlbs()
-> unmap_and_move_huge_page() <- Takes folio_lock!
-> remove_migration_ptes()
-> __rmap_walk_file()
-> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)!
hugetlbfs_fallocate()
-> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)!
-> hugetlbfs_zero_partial_page()
-> filemap_lock_hugetlb_folio()
-> filemap_lock_folio()
-> __filemap_get_folio <- Waits for folio_lock!
The migration path is the one taking locks in the wrong order according to
the documentation at the top of mm/rmap.c. So expand the scope of the
existing i_mmap_lock to cover the calls to remove_migration_ptes() too.
This is (mostly) how it used to be after commit c0d0381ade79. That was
removed by 336bf30eb765 for both file & anon hugetlb pages when it should
only have been removed for anon hugetlb pages.
Products Associated with CVE-2026-23097
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Linux Kernel. Just hit a watch button to start following.
Affected Versions
Linux:- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below e7396d23f9d5739f56cf9ab430c3a169f5508394 is affected.
- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below ad97b9a55246eb940a26ac977f80892a395cabf9 is affected.
- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below 5edb9854f8df5428b40990a1c7d60507da5bd330 is affected.
- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below 526394af4e8ade89cacd1a9ce2b97712712fcc34 is affected.
- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below b75070823b89009f5123fd0e05a8e0c3d39937c1 is affected.
- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below 1b68efce6dd483d22f50d0d3800c4cfda14b1305 is affected.
- Version 336bf30eb76580b579dc711ded5d599d905c0217 and below b7880cb166ab62c2409046b2347261abf701530e is affected.
- Version ef792d6ce0db6a56e56743b1de1716a982c3b851 is affected.
- Version 5.10 is affected.
- Before 5.10 is unaffected.
- Version 5.10.249, <= 5.10.* is unaffected.
- Version 5.15.199, <= 5.15.* is unaffected.
- Version 6.1.162, <= 6.1.* is unaffected.
- Version 6.6.122, <= 6.6.* is unaffected.
- Version 6.12.68, <= 6.12.* is unaffected.
- Version 6.18.8, <= 6.18.* is unaffected.
- Version 6.19, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.