All vulnerabilities
CVE-2026-98223

Linux: mm: filemap: retain mapped dropbehind folios

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2897601dffe576fcd87a4259102f41f7fb0cbfc8Also 77c0fade37c80e8aa16ac048a9828249055e3f66, 848d2ce2fce15fbdc083fbf9691bfa72911033c4CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2897601dffe576fcd87a4259102f41f7fb0cbfc8LinuxCVE List
  • 77c0fade37c80e8aa16ac048a9828249055e3f66LinuxCVE List
  • 848d2ce2fce15fbdc083fbf9691bfa72911033c4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: retain mapped dropbehind folios

Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the folio instead of forcibly unmapping it when writeback completes.

For a mapped folio, folio_unmap_invalidate() can call unmap_mapping_folio(), which takes i_mmap_rwsem and may sleep. Retaining mapped folios avoids this path when folio_end_dropbehind() runs in non-preemptible task context.

Tal was able to trigger a sleeping-in-atomic warning due to this [1].

Unmapped dropbehind folios continue through the existing invalidation path.

Text from CVE List

Affected versions 8

  • Linuxaffected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 before 2897601dffe576fcd87a4259102f41f7fb0cbfc8CVE List
  • Linuxaffected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 before 77c0fade37c80e8aa16ac048a9828249055e3f66CVE List
  • Linuxaffected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 before 848d2ce2fce15fbdc083fbf9691bfa72911033c4CVE List
  • Linuxaffected: 6.14CVE List
  • Linuxunaffected: all versions before 6.14CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3