CVE-2026-80729

In the Linux kernel, the following vulnerability has been resolved:

mm/huge memory: initialise workingset state before folio split

xas try split() adds GFP ACCOUNT for page-cache xa nodes, but folio split() leaves the xa state's xa lru unset. That lets a live, memcg-charged xa node exist without being linked into the mapping's shadow nodes list lru; when reclaim later walks the list lru it trips VM WARN ON(!css is dying()).

Use mapping set update() to install both the workingset update callback and the shadow nodes list lru on the xa state.