Package: src:linux Version: 6.12.113-1 Severity: important Tags: upstream Control: found -1 6.12.111-1
Dear Maintainer, Since the upgrade to 6.12.113-1, one of our KVM guests froze twice under page-cache reclaim. A second guest running 6.12.111-1 froze with similar symptoms during the same kind of workload, but that oops could not be captured; 6.12.111-1 is marked found because it contains the same upstream change (see below), not because of a captured trace. kswapd oopses with a NULL pointer dereference in list_lru_add() and dies while holding the mapping's xa_lock, so every subsequent reader of that file spins forever in __pv_queued_spin_lock_slowpath/kvm_wait and the guest becomes unresponsive. Oops (captured from guest memory, kernel otherwise untainted): BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 UID: 0 PID: 67 Comm: kswapd0 Not tainted 6.12.113+deb13-amd64 #1 Debian 6.12.113-1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:list_lru_add+0x83/0x110 Call Trace: list_lru_add_obj+0x7c/0xa0 workingset_update_node+0x8a/0xb0 xas_store+0x24e/0x670 __filemap_remove_folio+0x116/0x1e0 __remove_mapping+0xdf/0x220 shrink_folio_list+0xb62/0xd00 evict_folios+0x24f/0x650 try_to_shrink_lruvec+0x21b/0x2b0 shrink_one+0x102/0x1f0 shrink_node+0xa08/0xc40 balance_pgdat+0x520/0x9a0 kswapd+0x1f1/0x380 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 note: kswapd0[67] exited with irqs disabled note: kswapd0[67] exited with preempt_count 3 Workload: XFS root/data filesystem, many short-lived SSH sessions (each in its own systemd session scope / memcg) doing file deployments. No global memory pressure (about 60% of RAM available, swap unused). The freeze happened twice within 30 hours on 6.12.113-1. We never saw it on this guest with 6.12.107-1. Probable cause: stable 6.12.109 picked up ad812805fea7 "xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()" (upstream 789763523fb4) which makes xa_nodes allocated during folio split memcg-charged. The upstream dependency that installs the shadow_nodes list_lru on the xa_state during split, aca1f2d5de17 "mm/huge_memory: initialise workingset state before folio split" does not appear to be in 6.12.y (checked ChangeLog-6.12.109 to 6.12.113). Without it, a memcg-charged xa_node can reach workingset_update_node() for a memcg whose shadow_nodes list_lru was never allocated, hence the NULL+0x8 dereference (list_add_tail on l->list.prev). The same crash and analysis were reported on Amazon Linux 6.12.110: https://github.com/awslabs/amazon-eks-ami/issues/2845 Amazon shipped a fixed kernel (6.12.111-136.204) on 2026-10-12. Note: the security tracker marks CVE-2026-80729 (the aca1f2d5de17 fix) as "vulnerable code not present" for trixie. That is true for xas_try_split(), but the 6.12.109 backport reintroduces the same defect via xas_split_alloc(), so trixie is effectively affected. Since an unprivileged process filling page cache in its own memcg seems able to trigger it, this is also a local DoS on shared hosts. Workaround confirmed in place: booting with cgroup.memory=nokmem. Suggested fix: backport aca1f2d5de17 to 6.12.y (and 6.18.y, where the stable backport also failed to apply), or revert ad812805fea7 in the Debian package until stable catches up. We are reporting the regression to [email protected] / [email protected] as well and will link the thread here. -- Package-specific info: ** Version: Linux version 6.12.113+deb13-amd64 ([email protected]) (x86_64-linux-gnu-gcc-14 (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #1 SMP PREEMPT_DYNAMIC Debian 6.12.113-1 (2026-10-15) ** Command line: BOOT_IMAGE=/boot/vmlinuz-6.12.113+deb13-amd64 root=/dev/mapper/vg_root-rootfs ro cgroup.memory=nokmem console=tty0 console=ttyS0,115200 quiet ** Not tainted ** Model information sys_vendor: QEMU product_name: Standard PC (i440FX + PIIX, 1996) product_version: pc-i440fx-9.2 chassis_vendor: QEMU chassis_version: pc-i440fx-9.2 bios_vendor: SeaBIOS bios_version: rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org ** Configuration for modprobe: blacklist arkfb blacklist aty128fb blacklist atyfb blacklist radeonfb blacklist cirrusfb blacklist cyber2000fb blacklist kyrofb blacklist matroxfb_base blacklist mb862xxfb blacklist neofb blacklist pm2fb blacklist pm3fb blacklist s3fb blacklist savagefb blacklist sisfb blacklist tdfxfb blacklist tridentfb blacklist vt8623fb options snd_pcsp index=-2 options cx88_alsa index=-2 options snd_atiixp_modem index=-2 options snd_intel8x0m index=-2 options snd_via82xx_modem index=-2 options bonding max_bonds=0 options dummy numdummies=0 options ifb numifbs=0 options cgroup memory=nokmem ** Loaded modules: binfmt_misc intel_rapl_msr intel_rapl_common kvm_amd ccp kvm irqbypass crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 sha256_ssse3 sha1_ssse3 aesni_intel gf128mul crypto_simd bochs cryptd drm_vram_helper vga16fb drm_ttm_helper pcspkr vgastate ttm drm_kms_helper virtio_balloon button joydev evdev sg drm efi_pstore configfs nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock vmw_vmci qemu_fw_cfg ip_tables x_tables autofs4 xfs libcrc32c crc32c_generic hid_generic usbhid hid dm_mod sr_mod cdrom uhci_hcd ata_generic ehci_pci sd_mod virtio_net ehci_hcd ata_piix libata usbcore net_failover virtio_scsi psmouse failover scsi_mod serio_raw crc32_pclmul i2c_piix4 crc32c_intel i2c_smbus scsi_common usb_common floppy ** PCI devices: 00:00.0 Host bridge [0600]: Intel Corporation 440FX - 82441FX PMC [Natoma] [8086:1237] (rev 02) Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100] Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- 00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] [8086:7000] Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- 00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] [8086:7010] (prog-if 80 [ISA Compatibility mode-only controller, supports bus mastering]) Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Region 0: I/O ports at 01f0 [size=8] Region 1: I/O ports at 03f4 Region 2: I/O ports at 0170 [size=8] Region 3: I/O ports at 0374 Region 4: I/O ports at f0c0 [size=16] Kernel driver in use: ata_piix Kernel modules: ata_piix, ata_generic 00:01.2 USB controller [0c03]: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] [8086:7020] (rev 01) (prog-if 00 [UHCI]) Subsystem: Red Hat, Inc. QEMU Virtual Machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin D routed to IRQ 11 Region 4: I/O ports at f080 [size=32] Kernel driver in use: uhci_hcd Kernel modules: uhci_hcd 00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113] (rev 03) Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A routed to IRQ 9 Kernel driver in use: piix4_smbus Kernel modules: i2c_piix4 00:02.0 VGA compatible controller [0300]: Device [1234:1111] (rev 02) (prog-if 00 [VGA controller]) Subsystem: Red Hat, Inc. Device [1af4:1100] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Region 0: Memory at fd000000 (32-bit, prefetchable) [size=16M] Region 2: Memory at fea50000 (32-bit, non-prefetchable) [size=4K] Expansion ROM at 000c0000 [disabled] [size=128K] Kernel driver in use: bochs-drm Kernel modules: bochs 00:03.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon [1af4:1002] Subsystem: Red Hat, Inc. Device [1af4:0005] Physical Slot: 3 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 10 Region 0: I/O ports at f000 [size=64] Region 4: Memory at 382000000000 (64-bit, prefetchable) [size=16K] Capabilities: <access denied> Kernel driver in use: virtio-pci 00:05.0 PCI bridge [0604]: Red Hat, Inc. QEMU PCI-PCI bridge [1b36:0001] (prog-if 00 [Normal decode]) Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 11 Region 0: Memory at 380000000000 (64-bit, non-prefetchable) [size=256] Bus: primary=00, secondary=01, subordinate=01, sec-latency=0 I/O behind bridge: e000-efff [size=4K] [16-bit] Memory behind bridge: fe800000-fe9fffff [size=2M] [32-bit] Prefetchable memory behind bridge: 381800000000-381fffffffff [size=32G] [32-bit] Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR- BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B- PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn- Capabilities: <access denied> 00:08.0 Communication controller [0780]: Red Hat, Inc. Virtio console [1af4:1003] Subsystem: Red Hat, Inc. Device [1af4:0003] Physical Slot: 8 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 11 Region 0: I/O ports at f040 [size=64] Region 1: Memory at fea51000 (32-bit, non-prefetchable) [size=4K] Region 4: Memory at 382000004000 (64-bit, prefetchable) [size=16K] Capabilities: <access denied> Kernel driver in use: virtio-pci 00:12.0 Ethernet controller [0200]: Red Hat, Inc. Virtio network device [1af4:1000] Subsystem: Red Hat, Inc. Device [1af4:0001] Physical Slot: 18 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 10 Region 0: I/O ports at f0a0 [size=32] Region 1: Memory at fea52000 (32-bit, non-prefetchable) [size=4K] Region 4: Memory at 382000008000 (64-bit, prefetchable) [size=16K] Expansion ROM at fea00000 [disabled] [size=256K] Capabilities: <access denied> Kernel driver in use: virtio-pci 00:1e.0 PCI bridge [0604]: Red Hat, Inc. QEMU PCI-PCI bridge [1b36:0001] (prog-if 00 [Normal decode]) Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A routed to IRQ 10 Region 0: Memory at 380000001000 (64-bit, non-prefetchable) [size=256] Bus: primary=00, secondary=02, subordinate=02, sec-latency=0 I/O behind bridge: d000-dfff [size=4K] [16-bit] Memory behind bridge: fe600000-fe7fffff [size=2M] [32-bit] Prefetchable memory behind bridge: 381000000000-3817ffffffff [size=32G] [32-bit] Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR- BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B- PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn- Capabilities: <access denied> 00:1f.0 PCI bridge [0604]: Red Hat, Inc. QEMU PCI-PCI bridge [1b36:0001] (prog-if 00 [Normal decode]) Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A routed to IRQ 11 Region 0: Memory at 380000002000 (64-bit, non-prefetchable) [size=256] Bus: primary=00, secondary=03, subordinate=03, sec-latency=0 I/O behind bridge: c000-cfff [size=4K] [16-bit] Memory behind bridge: fe400000-fe5fffff [size=2M] [32-bit] Prefetchable memory behind bridge: 380800000000-380fffffffff [size=32G] [32-bit] Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR- BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B- PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn- Capabilities: <access denied> 01:01.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio SCSI [1af4:1004] (prog-if 00 [Vendor specific]) Subsystem: Red Hat, Inc. Device [1af4:0008] Physical Slot: 1-2 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 10 Region 0: I/O ports at e000 [size=64] Region 1: Memory at fe800000 (32-bit, non-prefetchable) [size=4K] Region 4: Memory at 381800000000 (64-bit, prefetchable) [size=16K] Capabilities: <access denied> Kernel driver in use: virtio-pci ** USB devices: not available -- System Information: Debian Release: 13.7 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.113+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages linux-image-6.12.113+deb13-amd64 depends on: ii initramfs-tools [linux-initramfs-tool] 0.148.4 ii kmod 34.2-2 ii linux-base 4.12.1 Versions of packages linux-image-6.12.113+deb13-amd64 recommends: ii apparmor 4.1.0-1 Versions of packages linux-image-6.12.113+deb13-amd64 suggests: pn debian-kernel-handbook <none> ii firmware-linux-free 20241210-2 ii grub-pc 2.12-9+deb13u2 pn linux-doc-6.12 <none> Versions of packages linux-image-6.12.113+deb13-amd64 is related to: pn firmware-amd-graphics <none> pn firmware-atheros <none> pn firmware-bnx2 <none> pn firmware-bnx2x <none> pn firmware-brcm80211 <none> pn firmware-cavium <none> pn firmware-cirrus <none> pn firmware-intel-graphics <none> pn firmware-intel-misc <none> pn firmware-intel-sound <none> pn firmware-ipw2x00 <none> pn firmware-ivtv <none> pn firmware-iwlwifi <none> pn firmware-libertas <none> pn firmware-marvell-prestera <none> pn firmware-mediatek <none> pn firmware-misc-nonfree <none> pn firmware-myricom <none> pn firmware-netronome <none> pn firmware-netxen <none> pn firmware-nvidia-graphics <none> pn firmware-qcom-soc <none> pn firmware-qlogic <none> pn firmware-realtek <none> pn firmware-samsung <none> pn firmware-siano <none> pn firmware-ti-connectivity <none> pn xen-hypervisor <none> -- no debconf information
