CVE-2026-64129
Received Received - Intake

Linux Kernel PMD Spinlock Leak in Memory Migration

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page When check_stable_address_space() fails after the PMD spinlock has been acquired via pmd_lock(), the code jumps directly to the abort label, bypassing the spin_unlock() call in unlock_abort. This causes the PMD spinlock to be permanently held, leading to a deadlock. Change the goto target from abort to unlock_abort to ensure the spinlock is always released on this error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64129
EUVD
EUVD-2026-45814

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a spinlock is not released properly. When a specific function fails after acquiring a lock, the code skips releasing the lock, causing a deadlock. The fix changes the error path to ensure the lock is always released.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management subsystem and does not have network-based detection methods. It requires kernel-level inspection. Check if your kernel version includes the fix by running uname -r and comparing it against the patched version. Look for system hangs or deadlocks during memory migration operations.

Impact Analysis

This vulnerability can cause system hangs or crashes due to deadlocks. If the PMD spinlock remains held, other processes waiting for the lock will be blocked, potentially freezing parts of the system or requiring a reboot.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level Linux kernel issue involving a spinlock leak in memory migration code. It may indirectly impact compliance if the deadlock causes system instability or service disruption in environments handling regulated data.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the fix is included. If immediate patching is not possible, avoid operations that trigger memory migration, such as using huge pages or device memory migration. Monitor system logs for spinlock-related errors or deadlocks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart