Medium 5.5Published Feb 4, 2026

CVE-2026-23097migrate: correct lock ordering for hugetlb file folios

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock. migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() <- Takes folio_lock! -> remove_migration_ptes() -> __rmap_walk_file() -> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)! hugetlbfs_fallocate() -> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)! -> hugetlbfs_zero_partial_page() -> filemap_lock_hugetlb_folio() -> filemap_lock_folio() -> __filemap_get_folio <- Waits for folio_lock! The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too. This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 336bf30eb76580b579dc711ded5d599d905c0217 before e7396d23f9d5739f56cf9ab430c3a169f5508394; from 336bf30eb76580b579dc711ded5d599d905c0217 before ad97b9a55246eb940a26ac977f80892a395cabf9; 336bf30eb76580b579dc711ded5d599d905c0217 builds before 5edb9854f8df5428b40990a1c7d60507da5bd330; from 336bf30eb76580b579dc711ded5d599d905c0217 before 526394af4e8ade89cacd1a9ce2b97712712fcc34; from 336bf30eb76580b579dc711ded5d599d905c0217 before b75070823b89009f5123fd0e05a8e0c3d39937c1; 336bf30eb76580b579dc711ded5d599d905c0217 builds before 1b68efce6dd483d22f50d0d3800c4cfda14b1305; from 336bf30eb76580b579dc711ded5d599d905c0217 before b7880cb166ab62c2409046b2347261abf701530e; ef792d6ce0db6a56e56743b1de1716a982c3b851; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.9.9 before 5.10; from 5.10.1 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 5.10; and 10 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e7396d23f9d5739f56cf9ab430c3a169f5508394	patch
https://git.kernel.org/stable/c/ad97b9a55246eb940a26ac977f80892a395cabf9	patch
https://git.kernel.org/stable/c/5edb9854f8df5428b40990a1c7d60507da5bd330	patch
https://git.kernel.org/stable/c/526394af4e8ade89cacd1a9ce2b97712712fcc34	patch
https://git.kernel.org/stable/c/b75070823b89009f5123fd0e05a8e0c3d39937c1	patch
https://git.kernel.org/stable/c/1b68efce6dd483d22f50d0d3800c4cfda14b1305	patch
https://git.kernel.org/stable/c/b7880cb166ab62c2409046b2347261abf701530e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.