---
id: CVE-2026-80729
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/huge_memory: initialise workingset state before folio split

  xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but
  __folio_split() leaves the xa_state's xa…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/huge_memory: initialise workingset state before folio split

  xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but
  __folio_split() leaves the xa_state's xa…
severity: low
published: '2026-09-03'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T14:17:07.213'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80729'
references:
  - url: 'https://git.kernel.org/stable/c/aca1f2d5de17e138bc6c4859126b77e516b82541'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dc87b56b43c9143f2405e434cff1530c3488b571'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80729.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80729'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527867'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80729'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80729'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80729.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-80729'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10645
ingestedAt: '2026-10-12T14:50:34.037Z'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 58729c04cf1092b87aeef0bf0998c9e2e4771133 <
    dc87b56b43c9143f2405e434cff1530c3488b571
  - >-
    Linux >= 58729c04cf1092b87aeef0bf0998c9e2e4771133 <
    d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55
  - >-
    Linux >= 58729c04cf1092b87aeef0bf0998c9e2e4771133 <
    aca1f2d5de17e138bc6c4859126b77e516b82541
  - Linux 6.15
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe:
  - CWE-664
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: initialise workingset state before folio split

xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but
__folio_split() leaves the xa_state's xa_lru unset.  That lets a live,
memcg-charged xa_node exist without being linked into the mapping's
shadow_nodes list_lru; when reclaim later walks the list_lru it trips
VM_WARN_ON(!css_is_dying()).

Use mapping_set_update() to install both the workingset update callback
and the shadow_nodes list_lru on the xa_state.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80729.json)