CVE-2026-80719 mm: mglru: fix stale batch updates after memcg reparenting
A race condition in the Linux kernel MGLRU subsystem can cause premature Out-of-Memory kills, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80719?
CVE-2026-80719 is a denial of service vulnerability in Linux, published on 28 Aug 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: mglru: fix stale batch updates after memcg reparenting
The mglru page table walker batches per-generation size deltas in walk->nr_pages while walking page tables without holding the lruvec lock. The reset_batch_size() later folds those deltas into walk->lruvec under the lruvec lock.
The page table walker can run concurrently with the memcg reparenting path as follows:
CPU0 CPU1 ==== ====
walk_mm --> walk_page_range --> update_batch_size --> walk->nr_pages += delta
mem_cgroup_css_offline --> memcg_reparent_objcgs --> lock lruvec lru_gen_reparent_memcg --> reparent child folios to parent unlock lruvec
lock lruvec reset_batch_size --> child lrugen->nr_pages += delta
This will trigger the following warning in lru_gen_exit_memcg():
VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0, sizeof(lruvec->lrugen.nr_pages)));
And the user-visible impact of underestimated nr_pages in MGLRU was premature OOMs because MGLRU does not try to reclaim memory when nr_pages reaches zero, but there are still more pages.
To fix it, make reset_batch_size() check CSS_DYING under RCU before flushing the pending batch. A non-dying memcg keeps the original lruvec stable against RCU-delayed offlining; a dying memcg redirects the deltas to the first non-dying ancestor.
Which versions are affected by CVE-2026-80719?
How do I fix CVE-2026-80719?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80719 being exploited?
There is no known exploitation of CVE-2026-80719 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-80719, GHSA-5jwv-p5cj-5p3c, UBUNTU-CVE-2026-80719.