CVE-2026-46017

In the Linux kernel, the following vulnerability has been resolved:

mm: fix deferred split queue races during migration

migrate_folio_move() records the deferred split queue state from src and

replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0)

makes dst visible before it is requeued, so a concurrent rmap-removal path

can mark dst partially mapped and trip the WARN in deferred_split_folio().

Move the requeue before remove_migration_ptes() so dst is back on the

deferred split queue before it becomes visible again.

Because migration still holds dst locked at that point, teach

deferred_split_scan() to requeue a folio when folio_trylock() fails.

Otherwise a fully mapped underused folio can be dequeued by the shrinker

and silently lost from split_queue.

[[email protected]: move the comment]