CVE-2026-89757

A moderate severity flaw was found in the Linux kernel's multi-generational LRU (MGLRU) memory management subsystem. The shortcut in sort_folio() that moves folios which are no longer evictable off an MGLRU generation list fails to initialise folio->mlock_count, allowing that field to alias the list poison value left behind by list_del(). When such a folio is subsequently munlocked, __munlock_folio() decrements the bogus count, finds it still non-zero, and returns before clearing PG_mlocked, so the folio remains unevictable and the Mlocked accounting stays inflated until the folio is freed. The shortcut also touches the LRU flags in the wrong order, calling lru_gen_del_folio() while PG_lru is still set, which can allow a concurrent folio_test_clear_lru() (for example during compaction or folio isolation) to succeed on a folio already removed from the generation list and lead to unexpected behavior. A local unprivileged user can trigger this through ordinary mlock/munlock activity on memory managed by MGLRU; the result is inflated memory accounting and memory pages that remain locked in memory, which can contribute to memory resource exhaustion and reduced system stability. Red Hat classifies this flaw as MODERATE impact with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), affecting only availability.

Red Hat Enterprise Linux 9 (kernel and kernel-rt, from the 9.4 update stream onward) and Red Hat Enterprise Linux 10, as well as Red Hat OpenShift Container Platform 4.16 and later (including 5.0 and 5.1) and Red Hat In-Vehicle OS 2.x, are affected. Because the issue is of moderate severity with a CVSS score below 7.0, the fix is deferred and no updates are currently planned for these products; the residual risk is that unevictable memory can accumulate with inflated accounting on affected systems until the corresponding folios are freed. Red Hat Enterprise Linux 7 and 8, the Red Hat Enterprise Linux 9.2 update stream, and Red Hat OpenShift Container Platform 4.12 through 4.15 are not affected because the vulnerable code is not present in the kernel versions shipped in those products.