Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-77181.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-77181
Upstream
Published
2026-02-04T17:16:20Z
Modified
2026-08-28T17:48:01.999672058Z
Summary
CVE-2026-23097 affecting package kernel for versions less than 6.6.126.1-1
Details

In the Linux kernel, the following vulnerability has been resolved:

migrate: correct lock ordering for hugetlb file folios

Syzbot has found a deadlock (analyzed by Lance Yang):

1) Task (5749): Holds foliolock, then tries to acquire immaprwsem(read lock). 2) Task (5754): Holds immaprwsem(write lock), then tries to acquire foliolock.

migratepages() -> migratehugetlbs() -> unmapandmovehugepage() <- Takes foliolock! -> removemigration_ptes() -> _rmapwalkfile() -> immaplockread() <- Waits for immaprwsem(read lock)!

hugetlbfsfallocate() -> hugetlbfspunchhole() <- Takes immaprwsem(write lock)! -> hugetlbfszeropartialpage() -> filemaplockhugetlbfolio() -> filemaplock_folio() -> _filemapgetfolio <- Waits for foliolock!

The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing immaplock to cover the calls to removemigrationptes() too.

This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.

References

Affected packages

Azure Linux:3 / kernel

Package

Name
kernel
Purl
pkg:rpm/azure-linux/kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.126.1-1

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-77181.json"