CVE-2026-89986

The Linux kernel's alloc_pages_bulk_weighted_interleave() hardcodes GFP_KERNEL when allocating a temporary weights array, even when it is invoked from atomic (non-sleeping) contexts. The bug is reached when an rhashtable rehash under rcu_read_lock() requests a GFP_ATOMIC bucket-table allocation that goes through vmalloc, and the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy, causing the kernel to attempt a sleeping allocation in an invalid context (a 'might sleep' splat). A local attacker with low privileges who can set a weighted-interleave memory policy could trigger kernel warnings and potential instability or denial of service. Any Linux system running a kernel containing the weighted-interleave mempolicy code is affected in principle, though triggering requires that specific policy to be in use, which is mostly seen on NUMA/multi-node servers. No public proof-of-concept or exploitation is known, and the flaw is not on the CISA KEV list.

What to do: Track your distribution's kernel advisory and update to a kernel that includes the upstream mm/mempolicy fix once backported. As an interim measure, avoid setting MPOL_WEIGHTED_INTERLEAVE memory policies on affected multi-node systems and limit unprivileged local users' ability to set custom mempolicies. Check kernel logs for 'sleeping function called from invalid context' splats referencing bucket_table_alloc or vmalloc paths as indicators of attempted triggering.