CVE-2026-23097: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23097 is a deadlock vulnerability in the Linux kernel caused by incorrect lock ordering in the migrate_hugetlbs() function when handling hugetlb file folios during memory migration. The flaw was discovered by Syzbot (analyzed by Lance Yang) and published on February 4, 2026. Affected kernel versions span multiple stable branches: 5.9.9–5.10 (before 5.10.249), 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.122, 6.7–6.12.68, and 6.13–6.18.8, as well as 6.19-rc1 through rc6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a lock ordering violation (CWE-667: Improper Locking) in the Linux kernel's memory migration subsystem. When two tasks concurrently operate on hugetlb pages, a circular wait condition arises: Task A holds folio_lock and waits to acquire i_mmap_rwsem (read), while Task B holds i_mmap_rwsem (write) and waits for folio_lock. The migration path (migrate_pages() → migrate_hugetlbs() → unmap_and_move_huge_page() → remove_migration_ptes() → __rmap_walk_file() → i_mmap_lock_read()) acquires locks in the wrong order relative to the documentation in mm/rmap.c. The regression was introduced by commit 336bf30eb765, which incorrectly removed i_mmap_lock protection for both file and anonymous hugetlb pages when it should only have been removed for anonymous pages. The fix expands the scope of i_mmap_lock to also cover calls to remove_migration_ptes() (Feedly).

A local attacker with low privileges can trigger this deadlock by concurrently initiating memory migration and hugetlbfs operations (e.g., hugetlbfs_fallocate() / hugetlbfs_punch_hole()), causing critical kernel threads to hang indefinitely. The impact is limited to availability — there is no confidentiality or integrity impact — but the resulting system freeze can be severe for workloads relying on hugetlb pages or frequent memory migration, such as high-performance computing, database servers, and virtualization hosts (Feedly).

Patches are available across all affected stable kernel branches. Administrators should upgrade to the following fixed versions: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, or 6.19-rc7 (development). Upstream patch commits include 1b68efce6dd4, 526394af4e8a, 5edb9854f8df, ad97b9a55246, b75070823b89, b7880cb166ab, and e7396d23f9d5 on git.kernel.org. Downstream distributions including Red Hat (RHSA-2026:3463, RHSA-2026:3464, RHSA-2026:3488, and others), AlmaLinux, Rocky Linux, Oracle Linux, Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, USN-8393-1), Amazon Linux 2, and Juniper JSA have released updates. For systems that cannot be immediately patched, limit local user access, restrict hugetlbfs usage where possible, and monitor for unexpected system hangs (Feedly).

The vulnerability was identified through Syzbot automated fuzzing, with analysis credited to Lance Yang. Multiple major Linux distributions — including Red Hat, Ubuntu, AlmaLinux, Rocky Linux, Oracle Linux, and Amazon Linux — issued security advisories and updated packages in the weeks following disclosure. Juniper Networks also addressed the flaw in Juniper Secure Analytics 7.5.0-UP15-IF01. Coverage has been noted on Linux security news aggregators and vendor reference sites (Feedly).