CVE-2026-64129

Analyzed Analyzed - Analysis Complete

Linux Kernel PMD Spinlock Leak in Memory Migration

Publication date: 2026-07-19

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page When check_stable_address_space() fails after the PMD spinlock has been acquired via pmd_lock(), the code jumps directly to the abort label, bypassing the spin_unlock() call in unlock_abort. This causes the PMD spinlock to be permanently held, leading to a deadlock. Change the goto target from abort to unlock_abort to ensure the spinlock is always released on this error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-13

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64129

EUVD

EUVD-2026-45814

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a spinlock is not released properly. When a specific function fails after acquiring a lock, the code skips releasing the lock, causing a deadlock. The fix changes the error path to ensure the lock is always released.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management subsystem and does not have network-based detection methods. It requires kernel-level inspection. Check if your kernel version includes the fix by running uname -r and comparing it against the patched version. Look for system hangs or deadlocks during memory migration operations.

Impact Analysis

This vulnerability can cause system hangs or crashes due to deadlocks. If the PMD spinlock remains held, other processes waiting for the lock will be blocked, potentially freezing parts of the system or requiring a reboot.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level Linux kernel issue involving a spinlock leak in memory migration code. It may indirectly impact compliance if the deadlock causes system instability or service disruption in environments handling regulated data.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the fix is included. If immediate patching is not possible, avoid operations that trigger memory migration, such as using huge pages or device memory migration. Monitor system logs for spinlock-related errors or deadlocks.

Hi! I’m here to help you understand CVE-2026-64129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70