https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:11:53 +0000 https://vulnerability.circl.lu/vuln/cve-2026-43404 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm: Fix a hmm_range_fault() livelock / starvation problem</p> <p>If hmm_range_fault() fails a folio_trylock() in do_swap_page, trying to acquire the lock of a device-private folio for migration, to ram, the function will spin until it succeeds grabbing the lock.</p> <p>However, if the process holding the lock is depending on a work item to be completed, which is scheduled on the same CPU as the spinning hmm_range_fault(), that work item might be starved and we end up in a livelock / starvation situation which is never resolved.</p> <p>This can happen, for example if the process holding the device-private folio lock is stuck in migrate_device_unmap()-&gt;lru_add_drain_all() sinc lru_add_drain_all() requires a short work-item to be run on all online cpus to complete.</p> <p>A prerequisite for this to happen is: a) Both zone device and system memory folios are considered in migrate_device_unmap(), so that there is a reason to call lru_add_drain_all() for a system memory folio while a folio lock is held on a zone device folio. b) The zone device folio has an initial mapcount &gt; 1 which causes at least one migration PTE entry insertion to be deferred to try_to_migrate(), which can happen after the call to lru_add_drain_all(). c) No or voluntary only preemption.</p> <p>This all seems pretty unlikely to happen, but indeed is hit by the &#34;xe_exec_system_allocator&#34; igt test.</p> <p>Resolve this by waiting for the folio to be unlocked i…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm: Fix a hmm_range_fault() livelock / starvation problem</p> <p>If hmm_range_fault() fails a folio_trylock() in do_swap_page, trying to acquire the lock of a device-private folio for migration, to ram, the function will spin until it succeeds grabbing the lock.</p> <p>However, if the process holding the lock is depending on a work item to be completed, which is scheduled on the same CPU as the spinning hmm_range_fault(), that work item might be starved and we end up in a livelock / starvation situation which is never resolved.</p> <p>This can happen, for example if the process holding the device-private folio lock is stuck in migrate_device_unmap()-&gt;lru_add_drain_all() sinc lru_add_drain_all() requires a short work-item to be run on all online cpus to complete.</p> <p>A prerequisite for this to happen is: a) Both zone device and system memory folios are considered in migrate_device_unmap(), so that there is a reason to call lru_add_drain_all() for a system memory folio while a folio lock is held on a zone device folio. b) The zone device folio has an initial mapcount &gt; 1 which causes at least one migration PTE entry insertion to be deferred to try_to_migrate(), which can happen after the call to lru_add_drain_all(). c) No or voluntary only preemption.</p> <p>This all seems pretty unlikely to happen, but indeed is hit by the &#34;xe_exec_system_allocator&#34; igt test.</p> <p>Resolve this by waiting for the folio to be unlocked i…</p> https://vulnerability.circl.lu/vuln/cve-2026-43404