{"id":"CVE-2026-80729","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: initialise workingset state before folio split\n\nxas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but\n__folio_split() leaves the xa_state's xa…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: initialise workingset state before folio split\n\nxas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but\n__folio_split() leaves the xa_state's xa…","severity":"low","published":"2026-09-03","updated":"2026-10-11","sourceUpdated":"2026-10-11T14:17:07.213","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80729","references":[{"url":"https://git.kernel.org/stable/c/aca1f2d5de17e138bc6c4859126b77e516b82541","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc87b56b43c9143f2405e434cff1530c3488b571","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80729.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80729"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527867"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80729"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80729"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80729.mbox"},{"url":"https://kernelcve.org/list/?q=CVE-2026-80729"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00206,"epssPercentile":0.10645,"ingestedAt":"2026-10-12T14:50:34.037Z","vendor":"Linux","product":"Linux","affected":["Linux >= 58729c04cf1092b87aeef0bf0998c9e2e4771133 < dc87b56b43c9143f2405e434cff1530c3488b571","Linux >= 58729c04cf1092b87aeef0bf0998c9e2e4771133 < d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55","Linux >= 58729c04cf1092b87aeef0bf0998c9e2e4771133 < aca1f2d5de17e138bc6c4859126b77e516b82541","Linux 6.15"],"cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":["CWE-664"],"slug":"CVE-2026-80729","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: initialise workingset state before folio split\n\nxas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but\n__folio_split() leaves the xa_state's xa_lru unset.  That lets a live,\nmemcg-charged xa_node exist without being linked into the mapping's\nshadow_nodes list_lru; when reclaim later walks the list_lru it trips\nVM_WARN_ON(!css_is_dying()).\n\nUse mapping_set_update() to install both the workingset update callback\nand the shadow_nodes list_lru on the xa_state.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80729.json)","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":229440,"id":"CVE-2026-80729","ts":1793019777383,"field":"cvss","old":null,"new":"3.3"},{"seq":229439,"id":"CVE-2026-80729","ts":1793019777383,"field":"severity","old":"none","new":"low"}]}