{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  mm: mglru: fix stale batch updates after memcg reparenting  The mglru page table walker batches per-generation size deltas in walk-\u003enr_pages while walking page tables without holding the lruvec lock.  The reset_batch_size() later folds those deltas into walk-\u003elruvec under the lruvec lock.  The page table walker can run concurrently with the memcg reparenting path as follows:  CPU0                           CPU1 ====                           ====  walk_mm --\u003e walk_page_range     --\u003e update_batch_size         --\u003e walk-\u003enr_pages += delta                                mem_cgroup_css_offline                               --\u003e memcg_reparent_objcgs                                   --\u003e lock lruvec                                       lru_gen_reparent_memcg                                       --\u003e reparent child folios to parent                                       unlock lruvec      lock lruvec     reset_batch_size     --\u003e child lrugen-\u003enr_pages += delta  This will trigger the following warning in lru_gen_exit_memcg():  \tVM_WARN_ON_ONCE(memchr_inv(lruvec-\u003elrugen.nr_pages, 0, \t\t\t\t   sizeof(lruvec-\u003elrugen.nr_pages)));  And the user-visible impact of underestimated nr_pages in MGLRU was premature OOMs because MGLRU does not try to reclaim memory when nr_pages reaches zero, but there are still more pages.  To fix it, make reset_batch_size() check CSS_DYING under RCU before flushing the pending batch.  A non-dying memcg keeps the original lruvec stable against RCU-delayed offlining; a dying memcg redirects the deltas to the first non-dying ancestor.",
  "id": "DEBIAN-CVE-2026-80719",
  "modified": "2026-09-14T16:47:36.258372496Z",
  "published": "2026-08-28T08:16:57.720Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80719"
    }
  ],
  "upstream": [
    "CVE-2026-80719"
  ]
}