{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "f304652609eae3814b0e9d11c75c0e0cb62da31f"
            },
            {
              "fixed": "fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"
            },
            {
              "fixed": "de4660898b7aa7e03d3b120a6bfa6b26211e4e77"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80719.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: mglru: fix stale batch updates after memcg reparenting\n\nThe mglru page table walker batches per-generation size deltas in\nwalk-\u003enr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk-\u003elruvec under\nthe lruvec lock.\n\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\n\nCPU0                           CPU1\n====                           ====\n\nwalk_mm\n--\u003e walk_page_range\n    --\u003e update_batch_size\n        --\u003e walk-\u003enr_pages += delta\n\n                              mem_cgroup_css_offline\n                              --\u003e memcg_reparent_objcgs\n                                  --\u003e lock lruvec\n                                      lru_gen_reparent_memcg\n                                      --\u003e reparent child folios to parent\n                                      unlock lruvec\n\n    lock lruvec\n    reset_batch_size\n    --\u003e child lrugen-\u003enr_pages += delta\n\nThis will trigger the following warning in lru_gen_exit_memcg():\n\n\tVM_WARN_ON_ONCE(memchr_inv(lruvec-\u003elrugen.nr_pages, 0,\n\t\t\t\t   sizeof(lruvec-\u003elrugen.nr_pages)));\n\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\n\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch.  A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor.",
  "id": "CVE-2026-80719",
  "modified": "2026-08-30T03:30:29.426129320Z",
  "published": "2026-08-28T06:53:16.087Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80719.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80719"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "mm: mglru: fix stale batch updates after memcg reparenting"
}