CVE Database›Document archive›CVE-2026-89753

CVE-2026-89753

kernel: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · September 11, 2026

Updated · October 18, 2026

Description

A flaw was found in the Linux kernel's memory management subsystem. The shrink_lruvec() function, responsible for memory reclaim, fails to properly report Read-Copy-Update (RCU) task quiescent states on systems with preemption enabled. This can lead to RCU task stalls, causing system unresponsiveness or a denial of service.

Statement

A low impact flaw was found in the Linux kernel's memory management subsystem. In the shrink_lruvec() memory reclaim path, the scan loop only calls cond_resched(), which is a no-op on kernels built with PREEMPTION support, and involuntary preemption does not count as a Tasks RCU quiescent state. A task performing direct reclaim under memory pressure can therefore never report a Tasks-RCU quiescent state and becomes a holdout task, triggering rcu_tasks stall warnings that can leave the system unresponsive and result in a local denial of service. An unprivileged local user can trigger this condition by inducing memory pressure on an affected system. The kernel packages in Red Hat Enterprise Linux 8 and 9 and the Red Hat Enterprise Linux CoreOS (RHCOS) kernels shipped with OpenShift Container Platform 4 are affected; Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present. The fix is deferred for the affected streams because the CVSS 3.1 score is below 7.0, so no trackers are being filed at this severity; the residual risk is limited to rcu_tasks stall warnings and temporary system unresponsiveness during heavy memory reclaim, with no impact on confidentiality or integrity. Upstream addressed this by using cond_resched_tasks_rcu_qs() in shrink_lruvec(), which reports a quiescent state even when cond_resched() does nothing.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-821 · Incorrect Synchronization