CVE-2026-89756

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate: report RCU-tasks quiescent states in migrate pages batch()

migrate pages batch() unmaps each folio before moving it, and every unmap runs the mmu notifier invalidate callbacks. On KVM hosts try to migrate() ends up in kvm mmu notifier invalidate range start() -> tdp mmu zap leafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time.

The loop already calls cond resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state.

A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet:

INFO: rcu tasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle cpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdp mmu zap leafs tdp mmu next root gfn to pfn cache invalidate start kvm mmu notifier invalidate range start mmu notifier invalidate range start try to migrate one try to migrate migrate pages batch migrate pages compact zone compact node kcompactd kthread

Use cond resched tasks rcu qs() so a quiescent state is reported even when cond resched() does nothing.

This has also been discussed at [1]