{"id":"CVE-2026-74644","state":"PUBLISHED","title":"mm/damon/ops-common: putback folios on invalid migrate nid","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/ops-common: putback folios on invalid migrate nid\n\ndamon_pa_migrate() and damos_va_migrate() isolate folios into a local list\nand then call damon_migrate_pages().  When target_nid is invalid\n(including the scheme default NUMA_NO_NODE / -1), damon_migrate_pages()\nreturns early without putting the folios back to the LRU.\n\nCallers then discard the list head while those folios remain isolated with\nan extra reference taken by folio_isolate_lru().  The pages stay off the\nLRU for as long as the mapping exists (anon active+inactive counts drop\nwhile RSS does not), and the leftover references can pin the pages after\nthe mapping is gone.\n\nPut the folios back on the invalid-nid path so ignored migration requests\nstill return them to the LRU.","publishedAt":"2026-08-22T15:32:21.899Z","updatedAt":"2026-08-23T12:47:57.298Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7c303fa1f311aadc17fa82b7bbf776412adf45de","status":"affected","lessThan":"7001c0a1bc9018cd5b2b72ebebb216d738b2ec81","versionType":"git"},{"version":"7e6c3130690a01076efdf45aa02ba5d5c16849a0","status":"affected","lessThan":"460181e4bb47a57776c64f0832c2096de8878cb3","versionType":"git"},{"version":"7e6c3130690a01076efdf45aa02ba5d5c16849a0","status":"affected","lessThan":"cfef454862b7d2776e0955b873dd59af6b47cfcb","versionType":"git"},{"version":"7e6c3130690a01076efdf45aa02ba5d5c16849a0","status":"affected","lessThan":"5deb65c34e682e7c5f5df417a70e223e8fcc5f5a","versionType":"git"},{"version":"9d0c2d15aff96746f99a7c97221bb8ce5b62db19","status":"affected","versionType":"git"},{"version":"6.12.44","status":"affected","lessThan":"6.12.105","versionType":"semver"},{"version":"6.16.4","status":"affected","lessThan":"6.17","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/damon/ops-common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.12.105","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/damon/ops-common.c"]}],"references":["https://git.kernel.org/stable/c/7001c0a1bc9018cd5b2b72ebebb216d738b2ec81","https://git.kernel.org/stable/c/460181e4bb47a57776c64f0832c2096de8878cb3","https://git.kernel.org/stable/c/cfef454862b7d2776e0955b873dd59af6b47cfcb","https://git.kernel.org/stable/c/5deb65c34e682e7c5f5df417a70e223e8fcc5f5a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74644.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74644","state":"PUBLISHED","datePublished":"2026-08-22T15:32:21.899Z","dateUpdated":"2026-08-23T12:47:57.298Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.923Z"},"containers":{"cna":{"title":"mm/damon/ops-common: putback folios on invalid migrate nid","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/ops-common: putback folios on invalid migrate nid\n\ndamon_pa_migrate() and damos_va_migrate() isolate folios into a local list\nand then call damon_migrate_pages().  When target_nid is invalid\n(including the scheme default NUMA_NO_NODE / -1), damon_migrate_pages()\nreturns early without putting the folios back to the LRU.\n\nCallers then discard the list head while those folios remain isolated with\nan extra reference taken by folio_isolate_lru().  The pages stay off the\nLRU for as long as the mapping exists (anon active+inactive counts drop\nwhile RSS does not), and the leftover references can pin the pages after\nthe mapping is gone.\n\nPut the folios back on the invalid-nid path so ignored migration requests\nstill return them to the LRU."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7c303fa1f311aadc17fa82b7bbf776412adf45de","status":"affected","lessThan":"7001c0a1bc9018cd5b2b72ebebb216d738b2ec81","versionType":"git"},{"version":"7e6c3130690a01076efdf45aa02ba5d5c16849a0","status":"affected","lessThan":"460181e4bb47a57776c64f0832c2096de8878cb3","versionType":"git"},{"version":"7e6c3130690a01076efdf45aa02ba5d5c16849a0","status":"affected","lessThan":"cfef454862b7d2776e0955b873dd59af6b47cfcb","versionType":"git"},{"version":"7e6c3130690a01076efdf45aa02ba5d5c16849a0","status":"affected","lessThan":"5deb65c34e682e7c5f5df417a70e223e8fcc5f5a","versionType":"git"},{"version":"9d0c2d15aff96746f99a7c97221bb8ce5b62db19","status":"affected","versionType":"git"},{"version":"6.12.44","status":"affected","lessThan":"6.12.105","versionType":"semver"},{"version":"6.16.4","status":"affected","lessThan":"6.17","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/damon/ops-common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.12.105","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/damon/ops-common.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/7001c0a1bc9018cd5b2b72ebebb216d738b2ec81"},{"url":"https://git.kernel.org/stable/c/460181e4bb47a57776c64f0832c2096de8878cb3"},{"url":"https://git.kernel.org/stable/c/cfef454862b7d2776e0955b873dd59af6b47cfcb"},{"url":"https://git.kernel.org/stable/c/5deb65c34e682e7c5f5df417a70e223e8fcc5f5a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:47:57.298Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.44","versionEndExcluding":"6.12.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16.4"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}