Answer in brief
CVE-2026-89986 records a High severity (CVSS 7.8) vulnerability in mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=fa3bea4e1f8202d787709b7e3654eb0a99aed758 <bcb3d0c867ee40dc48e9c085bf328fbc679b6656 || >=fa3bea4e1f8202d787709b7e3654eb0a99aed758 <0ceda28f371df9e0bbdaa29214f71fe8298f23d8 || >=fa3bea4e1f8202d787709b7e3654eb0a99aed758 <2943f1f4b7f2816177060eb9f551f2e6d8b629ba || >=fa3bea4e1f8202d787709b7e3654eb0a99aed758 <540e583b66d6402bf556fde5e53c817a54c1afe5 | bcb3d0c867ee40dc48e9c085bf328fbc679b6656, 0ceda28f371df9e0bbdaa29214f71fe8298f23d8, 2943f1f4b7f2816177060eb9f551f2e6d8b629ba, 540e583b66d6402bf556fde5e53c817a54c1afe5 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() syzbot reported a sleeping function called from invalid context splat in bucket_table_alloc(). When rhashtable_insert_slow() rehashes the table under rcu_read_lock(), it calls bucket_table_alloc(..., GFP_ATOMIC | __GFP_NOWARN). If the bucket table allocation uses vmalloc, __vmalloc_node_range_noprof() invokes vm_area_alloc_pages() -> alloc_pages_bulk_mempolicy_noprof() with the passed GFP_ATOMIC flags. If the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy, alloc_pages_bulk_weighted_interleave() is called and currently hardcodes GFP_KERNEL when allocating the temporary weights array, triggering a might_alloc() splat in atomic/RCU contexts. Pass the gfp flags (masked with GFP_RECLAIM_MASK to strip page-allocator zone modifiers like __GFP_HIGHMEM) received by alloc_pages_bulk_weighted_interleave() to kmalloc() instead of hardcoding GFP_KERNEL. Since the weights buffer is immediately initialized in full, kmalloc() is sufficient.
Quoted source text, attributed separately from HOL analysis.