In the Linux kernel, the following vulnerability has been resolved:
mm: fix deferred split queue races during migration
migratefoliomove() records the deferred split queue state from src and replays it on dst. Replaying it after removemigrationptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferredsplitfolio().
Move the requeue before removemigrationptes() so dst is back on the deferred split queue before it becomes visible again.
Because migration still holds dst locked at that point, teach deferredsplitscan() to requeue a folio when foliotrylock() fails. Otherwise a fully mapped underused folio can be dequeued by the shrinker and silently lost from splitqueue.
[ziy@nvidia.com: move the comment]
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46017.json",
"cna_assigner": "Linux"
}