CVE-2026-89755

A flaw exists in the Linux kernel's device page-migration path, __migrate_device_pages(), which saves a folio's mapping before calling folio_free_swap(); if the folio is freed from the swap cache, the stale swap_space mapping is later passed to folio_migrate_mapping(), causing it to operate on swap_space.i_pages with invalid reference accounting and eventually triggering a kernel BUG (folio reference count). A related defect failed to reset the page count to 1 after splitting a large folio, so split folios were processed with the original folio's count. An attacker needs local, low-privilege code execution on a system whose workload drives device-backed migration (the migrate_device path, e.g., ZONE_DEVICE/GPU-style shared-virtual-memory drivers) over pages resident in the swap cache; the observed outcome is kernel memory-management corruption ending in a BUG, i.e., a denial of service, though the CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates worst-case confidentiality and integrity as high. Any system running an affected kernel that exercises this code path is exposed. The issue is not in the CISA KEV catalog, no public proof of concept exists, and no exploitation is known.

What to do: Update to a kernel containing the upstream fix (which refreshes the folio mapping after folio_free_swap() and resets nr to 1 after folio splitting) as soon as your distribution ships it, and reboot to load the patched kernel. Prioritize hosts that combine untrusted local users with workloads using device-backed page migration (e.g., GPU shared-virtual-memory or ZONE_DEVICE drivers), since those are the realistic trigger conditions. Monitor kernel logs for BUG/oops reports in the memory-migration or folio-reference-count paths as an indicator of attempted triggering.