In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batch() unmaps each folio before moving it, and every unmap runs the mmu_notifier invalidate callbacks. On KVM hosts try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time. The loop already calls cond_resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state. A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet: INFO: rcu_tasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdp_mmu_zap_leafs tdp_mmu_next_root gfn_to_pfn_cache_invalidate_start kvm_mmu_notifier_invalidate_range_start __mmu_notifier_invalidate_range_start try_to_migrate_one try_to_migrate migrate_pages_batch migrate_pages compact_zone compact_node kcompactd kthread Use cond_resched_tasks_rcu_qs() so a quiescent state is reported even when cond_resched() does nothing. This has also been discussed at [1]

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent
    states in migrate_pages_batch() migrate_pages_batch() unmaps each folio before moving it, and every unmap
    runs the mmu_notifier invalidate callbacks. On KVM hosts try_to_migrate() ends up in
    kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is expensive, so unmapping a large
    batch keeps the CPU busy for a long time. The loop already calls cond_resched(), but on PREEMPTION kernels
    that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state. A long batch therefore
    never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout,
    stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet: INFO: rcu_tasks detected
    stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0
    state:R running task Call Trace: tdp_mmu_zap_leafs tdp_mmu_next_root gfn_to_pfn_cache_invalidate_start
    kvm_mmu_notifier_invalidate_range_start __mmu_notifier_invalidate_range_start try_to_migrate_one
    try_to_migrate migrate_pages_batch migrate_pages compact_zone compact_node kcompactd kthread Use
    cond_resched_tasks_rcu_qs() so a quiescent state is reported even when cond_resched() does nothing. This
    has also been discussed at [1] (CVE-2026-89756)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batch() unmaps each     folio before moving it, and every unmap runs the mmu_notifier invalidate callbacks. On KVM hosts     try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is     expensive, so unmapping a large batch keeps the CPU busy for a long time. The loop already calls     cond_resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU     quiescent state. A long batch therefore never reports a quiescent state, and the migrating task (e.g.
    kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common     at Meta fleet: INFO: rcu_tasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401     holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdp_mmu_zap_leafs     tdp_mmu_next_root gfn_to_pfn_cache_invalidate_start kvm_mmu_notifier_invalidate_range_start
    __mmu_notifier_invalidate_range_start try_to_migrate_one try_to_migrate migrate_pages_batch migrate_pages     compact_zone compact_node kcompactd kthread Use cond_resched_tasks_rcu_qs() so a quiescent state is     reported even when cond_resched() does nothing. This has also been discussed at [1] (CVE-2026-89756)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472604	Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2	Tenable Cloud Security	Google COS Security Checks	Local	medium
472604	Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
470357	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Cloud Security	Google COS Security Checks	Local	medium
470357	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345038	Linux Distros Unpatched Vulnerability : CVE-2026-89756	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-89756

medium

Tenable Plugins

medium

medium

high

medium

medium

high

medium