Improper locking in Linux kernel - CVE-2026-89985
Published: September 16, 2026
Vulnerability identifier: #VU150303
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89985
CWE-ID: CWE-667
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to compromise confidentiality, integrity, and availability.
The vulnerability exists due to improper locking in the memory cgroup folio migration and reparenting logic when migrating folios across NUMA nodes during memory cgroup reparenting. A local user can trigger folio migration across nodes to compromise confidentiality, integrity, and availability.
Memory cgroup reparenting processes one node at a time.
Affected software
Linux kernel
How to mitigate CVE-2026-89985
Install security update from vendor's repository.