migrate: correct lock ordering for hugetlb file folios(CVE-2026-23097)

概要

migrate: correct lock ordering for hugetlb file folios

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In the Linux kernel, the following vulnerability has been resolved:

migrate: correct lock ordering for hugetlb file folios

Syzbot has found a deadlock (analyzed by Lance Yang):

Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).
Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire
folio_lock.

migrate_pages()
-> migrate_hugetlbs()
-> unmap_and_move_huge_page() <- Takes folio_lock!
-> remove_migration_ptes()
-> __rmap_walk_file()
-> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)!

hugetlbfs_fallocate()
-> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)!
-> hugetlbfs_zero_partial_page()
-> filemap_lock_hugetlb_folio()
-> filemap_lock_folio()
-> __filemap_get_folio <- Waits for folio_lock!

The migration path is the one taking locks in the wrong order according to
the documentation at the top of mm/rmap.c. So expand the scope of the
existing i_mmap_lock to cover the calls to remove_migration_ptes() too.

This is (mostly) how it used to be after commit c0d0381ade79. That was
removed by 336bf30eb765 for both file & anon hugetlb pages when it should
only have been removed for anon hugetlb pages.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"5.10.0"},{"fixed":"5.10.249"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.199"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.162"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.122"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.68"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.8"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

BellSoft Alpaquita BELL-CVE-2026-23097 linux-lts 修正版: 6.1.163-r0
Debian DEBIAN-CVE-2026-23097 linux 修正版: 5.10.249-1
Ubuntu UBUNTU-CVE-2026-23097 linux-hwe-edge

概要

原文の説明

影響パッケージ

ディストリビューション別の修正状況

参照URL