CVE-2026-89757: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89757 is a memory accounting flaw in the Linux kernel's Multi-Generational LRU (mm/mglru) subsystem, specifically in the sort_folio() function's handling of unevictable folios. The bug causes mlock_count to be aliased with LIST_POISON2 (value 0x122/290), leading to incorrect Mlocked accounting and a denial-of-service condition. It affects Linux kernel versions from 6.1 up to (but not including) the fixed commits in the 6.18 and 7.2 stable series. The vulnerability was published on September 11, 2026, and is rated HIGH severity with an EPSS score of approximately 0.184% (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-911 (Improper Update of Reference Count). In sort_folio(), a shortcut for moving unevictable folios between generation lists fails to initialize mlock_count after lru_gen_del_folio() has already poisoned folio->lru via list_del(), causing mlock_count to alias LIST_POISON2 (0x122 = 290). Additionally, the shortcut calls lru_gen_del_folio() while PG_lru is still set, creating a race condition with concurrent folio_test_clear_lru() operations (e.g., during compaction or folio_isolate_lru()). The fix isolates affected folios as common folios and routes them through the generic shrink path, matching classical LRU behavior (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows any local user to corrupt kernel memory accounting by performing munlock operations on memory regions, causing unevictable folios to remain incorrectly marked as locked with inflated Mlocked accounting. This persists until the affected pages are freed, progressively degrading system memory management and potentially causing a denial-of-service condition. There is no evidence of confidentiality or integrity impact; the primary consequence is availability degradation through corrupted memory reclaim behavior (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access to trigger, limiting its attack surface. The EPSS score is approximately 0.184% (8th percentile), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Red Hat Advisory).

Apply the upstream Linux kernel patches that fix mlock_count initialization and correct the PG_lru flag ordering in sort_folio(). Fixed commits are available at 54a58d6656dd403b686b247f0bad8507cbfb45df, 15d3a2a71c8bf7333d019d249ee33669e69e4275, and f7e698e326b239a91ea15844817551921209e826 in the stable kernel tree. Patched versions include Linux 6.18.51 and 7.2.4 or later; users should update to a patched kernel version provided by their distribution (Github Advisory, Red Hat Bugzilla).