CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2026-89756

Description

A flaw was found in the Linux kernel. When performing memory migration on KVM (Kernel-based Virtual Machine) hosts, the migrate_pages_batch() function fails to report RCU (Read-Copy Update) tasks quiescent states during large batch unmapping operations. This oversight causes the migrating task to become an RCU holdout, leading to a prolonged stall in the RCU grace period. This can result in a Denial of Service (DoS) by keeping the CPU busy for an extended duration.

Statement

A flaw of MODERATE impact was found in the Linux kernel as shipped in Red Hat Enterprise Linux and used in Red Hat OpenShift Container Platform (RHEL CoreOS). During large batch memory migration on KVM hosts, migrate_pages_batch() unmaps each folio before moving it, and every unmap runs expensive mmu_notifier invalidation callbacks (on KVM hosts this reaches tdp_mmu_zap_leafs()), keeping the CPU busy for a long time. The migration loop only calls cond_resched(), which is a no-op on PREEMPTION kernels, and involuntary preemption is not a Tasks-RCU quiescent state. As a result, a long migration batch never reports a quiescent state and the migrating task (for example kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes. A local user able to trigger heavy memory migration or compaction can exploit this to keep the CPU busy for an extended duration, causing a denial of service; confidentiality and integrity are not impacted. Multiple Red Hat Enterprise Linux 8, 9, and 10 kernel streams and OpenShift Container Platform RHCOS builds are affected, while Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that stream. Because the flaw is rated MODERATE with a CVSS3 score of 5.5 (below the 7.0 threshold), the fix is currently deferred and no bug trackers are filed; the residual risk is a temporary system-wide slowdown or stall limited to systems running specific large memory-migration workloads on KVM hosts.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.5N/AN/A
Attack VectorLocalN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredLowN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityNoneN/AN/A
Integrity ImpactNoneN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Frequently Asked Questions

Want to get errata notifications? Sign up here.