CVE-2026-74644mm/damon/ops-common: putback folios on invalid migrate nid
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damon_pa_migrate() and damos_va_migrate() isolate folios into a local list and then call damon_migrate_pages(). When target_nid is invalid (including the scheme default NUMA_NO_NODE / -1), damon_migrate_pages() returns early without putting the folios back to the LRU. Callers then discard the list head while those folios remain isolated with an extra reference taken by folio_isolate_lru(). The pages stay off the LRU for as long as the mapping exists (anon active+inactive counts drop while RSS does not), and the leftover references can pin the pages after the mapping is gone. Put the folios back on the invalid-nid path so ignored migration requests still return them to the LRU.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7c303fa1f311aadc17fa82b7bbf776412adf45de before 7001c0a1bc9018cd5b2b72ebebb216d738b2ec81; from 7e6c3130690a01076efdf45aa02ba5d5c16849a0 before 460181e4bb47a57776c64f0832c2096de8878cb3; from 7e6c3130690a01076efdf45aa02ba5d5c16849a0 before cfef454862b7d2776e0955b873dd59af6b47cfcb; 7e6c3130690a01076efdf45aa02ba5d5c16849a0 builds before 5deb65c34e682e7c5f5df417a70e223e8fcc5f5a; 9d0c2d15aff96746f99a7c97221bb8ce5b62db19; from 6.12.44 before 6.12.105; from 6.16.4 before 6.17 | CNA record |
References
- https://git.kernel.org/stable/c/7001c0a1bc9018cd5b2b72ebebb216d738b2ec81
- https://git.kernel.org/stable/c/460181e4bb47a57776c64f0832c2096de8878cb3
- https://git.kernel.org/stable/c/cfef454862b7d2776e0955b873dd59af6b47cfcb
- https://git.kernel.org/stable/c/5deb65c34e682e7c5f5df417a70e223e8fcc5f5a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.