From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC0763B8D40 for ; Tue, 6 Oct 2026 10:24:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282262; cv=none; b=nintQSk/cmLFsIKS58T80wxOdYji3ojUJvGwbuz1ncwP5+o46hrHIgn6UEM6cX7ZsRwQGTqkWD/h7JSN6XJQNS9DXsiCNhs24EZyvBUQuwrCUG2m//BgwRLYX86EvkQNXLBsSKomysK457wP5KqVM9N7AInR81RCUrtzTPgJAcE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282262; c=relaxed/simple; bh=NqxdjclqcSODqeqnDSgC7LUcPtygNOFlsujcat0SLkU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=tMWeC4j/m6bcCyoAuX+FHdxBSIhdRqvLfwmMGY6ZwQ2semv8TlcegQg+trSpjrZ2m+hgQSgB7c4v6KDsrDmkQR+BdyZ+fmFLUndPDP0vIuB1LK3UL9+KYpkN/JxOFvcdrUC0YOxQXWOvFq7duYV/DV+A2wfSiY5J3nuTyq+nYP0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hjdAIyBf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hjdAIyBf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2260F1F000FF; Tue, 6 Oct 2026 10:24:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791282261; bh=Q1f0M8kzA8R73q4GVqeB8cuQbmr8gF9apfsG28SU/h4=; h=From:To:Cc:Subject:Date:Reply-To; b=hjdAIyBfkKr+Y0wSFip7uNs5g0RhuxQPTBGtj/ubIYQql+a2iJUmYpqb1gSmKzst8 RORbiFictRcPxjnqZKzj04yQJt9Qkz8auR4V4o2KLoFNmpltThv1eg0rYK4TdsF7kt nxsI4xoF7HyaRSk1VRC2+aP/Og9rQ79AnQWCejJc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98223: mm: filemap: retain mapped dropbehind folios Date: Tue, 6 Oct 2026 10:45:24 +0200 Message-ID: <2026100643-CVE-2026-98223-b511@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2602; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=GJoG/7iJ9DzzgeRtgremdvHe1bY5fDM/3Br0Qqb2xFs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlHtvxeUfSgMHmxjf8XpjfSNdZRkhHLXvsyimyN2HGG1 yepwSO4I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbi2cMwz+i/0ke355yBKVuP O04xkdiVkdA4nWFBQ+qeOY9bOyRsy4N272qQalzDM/MJAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the folio instead of forcibly unmapping it when writeback completes. For a mapped folio, folio_unmap_invalidate() can call unmap_mapping_folio(), which takes i_mmap_rwsem and may sleep. Retaining mapped folios avoids this path when folio_end_dropbehind() runs in non-preemptible task context. Tal was able to trigger a sleeping-in-atomic warning due to this [1]. Unmapped dropbehind folios continue through the existing invalidation path. The Linux kernel CVE team has assigned CVE-2026-98223 to this issue. Affected and fixed versions =========================== Issue introduced in 6.14 with commit fb7d3bc4149395c1ae99029c852eab6c28fc3c88 and fixed in 6.18.54 with commit 2897601dffe576fcd87a4259102f41f7fb0cbfc8 Issue introduced in 6.14 with commit fb7d3bc4149395c1ae99029c852eab6c28fc3c88 and fixed in 7.2.8 with commit 77c0fade37c80e8aa16ac048a9828249055e3f66 Issue introduced in 6.14 with commit fb7d3bc4149395c1ae99029c852eab6c28fc3c88 and fixed in 7.3-rc4 with commit 848d2ce2fce15fbdc083fbf9691bfa72911033c4 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98223 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: mm/filemap.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2897601dffe576fcd87a4259102f41f7fb0cbfc8 https://git.kernel.org/stable/c/77c0fade37c80e8aa16ac048a9828249055e3f66 https://git.kernel.org/stable/c/848d2ce2fce15fbdc083fbf9691bfa72911033c4