CVE-2026-89755

A flaw was found in the Linux kernel's device migration mechanism. When a memory page is freed from the swap cache, a stale mapping of that page might still be used. This incorrect memory accounting can lead to a system crash or instability.

A stale folio mapping can be used during migrate_device after folio_free_swap removes the folio from the swap cache. The migration path may then treat the folio as still mapped through swap_space and operate on swap_space.i_pages with invalid reference accounting. This can trigger a folio reference count BUG and crash the kernel. For the CVSS the PR:L value is used because practical triggering requires local code execution with access to a device migration path such as a GPU or accelerator driver interface, but not necessarily full administrator privileges. The issue is not network reachable. Impact is at least local denial of service via kernel crash. In the paranoid interpretation, limited confidentiality or integrity impact is kept possible because MM reference accounting errors can be UAF adjacent, but no arbitrary write primitive is proven by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.