Public bug reported:
## Summary
On Ubuntu 22.04.5 with `linux-image-6.8.0-138-generic` (source `linux-hwe-6.8`,
`6.8.0-138.138~22.04.1`, upstream base 6.8.12), this machine has hit **5 kernel
oops/panics in 9 days**, all inside the `mm/` page-accounting / reclaim code:
```
uncharge_folio+0x189 (mm/memcontrol.c) GPF, process exit path
mem_cgroup_update_lru_size() lru_size underflow (mm/memcontrol.c:1460)
rmqueue_bulk+0x11b (mm/page_alloc.c) GPF on LIST_POISON in PCP
list
lru_gen_add_folio / lru_gen_eviction / __lruvec_stat_mod_folio
```
Every one of them is preceded by, or accompanied by, the page's memcg accounting
disagreeing with the page's actual state (`BUG: Bad page state ... page still
charged
to cgroup`, `lru_size -1`, or a folio→memcg pointer that resolves to garbage).
**This is not MGLRU-specific.** MGLRU was explicitly disabled
(`/sys/kernel/mm/lru_gen/enabled
= 0x0000`, verified in the boot log) for the most recent crash, which still
happened in
the generic memcg uncharge path.
## Hardware / software
```
Ubuntu 22.04.5 LTS, kernel 6.8.0-138-generic #138~22.04.1-Ubuntu
/proc/version_signature: Ubuntu 6.8.0-138.138~22.04.1-generic 6.8.12
DMI: MECHREVO M5 / H45 / BIOS J002NS4 (2023-08-23)
CPU: 12th Gen Intel Core i5-12450H (12 threads)
RAM: 15.4 GiB (2x8 GB DDR4, dual channel, no ECC)
cgroup v2 (unified) only, memory.max = max, swap = 2 GiB swapfile
CONFIG_MEMCG=y CONFIG_MEMCG_KMEM=y CONFIG_SWAP=y CONFIG_LRU_GEN=y
CONFIG_LRU_GEN_ENABLED=y CONFIG_LRU_GEN_WALKS_MMU=y
# CONFIG_DEBUG_VM is not set, # CONFIG_KASAN is not set
```
## The crashes
| # | When (local, CST) | RIP | Fault address | Process | MGLRU |
|---|---|---|---|---|---|
| 1 | 2026-10-11 15:34:55 | `lru_gen_add_folio+0x287/0x460` |
`0xdead000000000108` | Compositor | on |
| 1b | same boot | `__rmqueue_pcplist+0x52/0x2e0` | `0xdead000000000108` |
Chrome_ChildIOT | on |
| 2 | 2026-10-14 21:38:46 | `lru_gen_eviction+0xbb/0x1c0` | `0xe89068b86349359`
| kswapd0 | on |
| 3 | 2026-10-14 22:47:22 | `__lruvec_stat_mod_folio+0x57/0xc0` |
`0x37d000000000621` | ThreadPoolForeg | on |
| 4 | 2026-10-17 09:07:04 | `rmqueue_bulk+0x11b/0x780` | `0xdead000000000108` |
qoder | on |
| **5** | **2026-10-20 01:40:25** | **`uncharge_folio+0x189/0x230`** |
**`0xffff1323224727a0`** | **ThreadPoolForeg** | **off (0x0000)** |
Event 5, full trace in `03-evidence.txt`:
```
general protection fault, probably for non-canonical address
0xffff1323224727a0: 0000 [#1] PREEMPT SMP NOPTI
CPU: 6 PID: 26610 Comm: ThreadPoolForeg Not tainted 6.8.0-138-generic
RIP: 0010:uncharge_folio+0x189/0x230
Code: ... 49 8b 46 10 a8 03 75 6a <65> 48 ff 00 ...
RAX: ffff899072b727a0 R13: ffff898f4e2ecff8 R14: ffffe9fdcc35ab88
Call Trace:
__mem_cgroup_uncharge_list+0x62/0xb0
release_pages+0x13a/0x490
free_pages_and_swap_cache+0x4a/0x60
tlb_batch_pages_flush+0x43/0x80
tlb_flush_mmu+0x3a/0x120
zap_pte_range+0x707/0xc30
unmap_vmas+0xb5/0x190
exit_mmap+0x10a/0x3f0
mmput/exit_mm/do_exit
```
The faulting instruction is `incq %gs:(%rax)` — a per-CPU add through a pointer
taken
from the folio/memcg side, resolving to a non-canonical address.
**In the same second** (`mm/memcontrol.c:1460`):
```
mem_cgroup_update_lru_size(00000000c92e446b, 0, -1): lru_size -1
WARNING: CPU: 7 PID: 26540 Comm: Chrome_ChildIOT Tainted: G D
```
After the oops the task never released its RCU read-side section, so the box
spent the
next 35 minutes in a repeating `rcu_preempt detected stalls ... P26610` cascade
—
logind/dbus calls timed out, the desktop became unusable, and the machine had
to be
power-cycled.
Event 4 is the same family seen from the allocator side — 32 `BUG: Bad page
state`
reports in ~1 s, all for ext4 page-cache pages of one file, every one with
`page dumped because: page still charged to cgroup`, followed 37 ms later by
`rmqueue_bulk` walking a PCP list whose `next` pointer was `LIST_POISON1`.
## What has been excluded
* **RAM**: `memtest86+` from USB, **12 passes, 0 errors, 9 h 45 min** over the
full
15.4 GiB. (The same tool found a genuinely bad DIMM on this machine in Aug
2026 with
4 passes, so it is sensitive here.) No ECC, so this is the strongest
available check.
* **Disk**: NVMe SMART clean; ext4 `fsck` clean.
* **Applications**: the crashing processes are Chrome/Qoder/VS Code worker
threads, but
the bad pages belong to unrelated memory (e.g. a FITS file's page cache), and
the
same fault class hits `kswapd0` with no application involved.
* **MGLRU**: disabled for event 5, crash persisted.
## Reproduction attempts (negative)
Synthetic loads did **not** reproduce it:
* 900 sequential `app.slice` transient scopes, 48 MB shmem each → nothing
* 60 batches x 8 concurrent scopes x 256 MB (2 GB per batch) → nothing
* 8 GiB anonymous ballast (MemAvailable ~2 GiB) + 2657 scope churn cycles with
direct reclaim active (`pgscan_direct` 44k, `pswpout` ~33k pages) → nothing
Total ~3600 cgroup create/destroy cycles, zero warnings. The trigger appears to
need
real Chromium-family process behaviour (threads, i915 GEM buffers, shared
memory)
and/or many hours of uptime, not just memory pressure.
## Impact
Machine is unusable after each event (hard power-off required; this model has no
battery, so every event is an unclean shutdown). 5 events in 9 days.
## What I can do to help
* Run any debug kernel / patch (KASAN, page_owner, debug_pagealloc) if you tell
me which one.
* Test a mainline kernel if that helps narrow it down.
* Provide full `pstore` dumps, journals and the reproduction scripts.
## Attachments
* `03-evidence.txt` — assembled bundle (system info, all five traces, MGLRU
evidence,
reproduction attempts)
* `journal_20261020_crash_excerpt.log` — 01:35–02:16 window covering event 5
and the
RCU stall cascade (273 KB). The full journal of that boot (2.3 MB) is
available on request.
* `journal_boot-5_20261014_crash.log`, `journal_boot-3_20261014_crash.log` —
events 2 and 3
* `pstore-179170409/`, `pstore-179198512/`, `pstore-179198924/`,
`pstore-179219922/`,
`pstore-179243162/` — EFI pstore dmesg dumps (each directory = one oops/panic)
---
ProblemType: Bug
ApportVersion: 2.20.11-0ubuntu82.10
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: ajst 2623 F.... pulseaudio
/dev/snd/controlC1: ajst 2623 F.... pulseaudio
CRDA: N/A
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 22.04
InstallationDate: Installed on 2024-03-16 (948 days ago)
InstallationMedia: Ubuntu 22.04.4 LTS "Jammy Jellyfish" - Release amd64
(20240220)
MachineType: MECHREVO M5
Package: linux (not installed)
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic
root=UUID=e7bc3822-7d1c-4573-8569-c0706eefb3ac ro quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 6.8.0-138.138~22.04.1-generic 6.8.12
RelatedPackageVersions:
linux-restricted-modules-6.8.0-138-generic N/A
linux-backports-modules-6.8.0-138-generic N/A
linux-firmware 20220329.git681281e4-0ubuntu3.42
Tags: jammy
Uname: Linux 6.8.0-138-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin lxd plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 08/23/2023
dmi.bios.release: 5.27
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: J002NS4
dmi.board.asset.tag: Default string
dmi.board.name: H45
dmi.board.vendor: MECHREVO
dmi.board.version: V1.0
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 3
dmi.chassis.vendor: MECHREVO
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrJ002NS4:bd08/23/2023:br5.27:svnMECHREVO:pnM5:pvr:rvnMECHREVO:rnH45:rvrV1.0:cvnMECHREVO:ct3:cvr:sku800046290:
dmi.product.family: WuJie
dmi.product.name: M5
dmi.product.sku: 800046290
dmi.sys.vendor: MECHREVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: apport-collected jammy
** Tags added: apport-collected jammy
** Description changed:
## Summary
On Ubuntu 22.04.5 with `linux-image-6.8.0-138-generic` (source
`linux-hwe-6.8`,
`6.8.0-138.138~22.04.1`, upstream base 6.8.12), this machine has hit **5
kernel
oops/panics in 9 days**, all inside the `mm/` page-accounting / reclaim code:
```
uncharge_folio+0x189 (mm/memcontrol.c) GPF, process exit path
mem_cgroup_update_lru_size() lru_size underflow (mm/memcontrol.c:1460)
rmqueue_bulk+0x11b (mm/page_alloc.c) GPF on LIST_POISON in PCP
list
lru_gen_add_folio / lru_gen_eviction / __lruvec_stat_mod_folio
```
Every one of them is preceded by, or accompanied by, the page's memcg
accounting
disagreeing with the page's actual state (`BUG: Bad page state ... page still
charged
to cgroup`, `lru_size -1`, or a folio→memcg pointer that resolves to garbage).
**This is not MGLRU-specific.** MGLRU was explicitly disabled
(`/sys/kernel/mm/lru_gen/enabled
= 0x0000`, verified in the boot log) for the most recent crash, which still
happened in
the generic memcg uncharge path.
## Hardware / software
```
Ubuntu 22.04.5 LTS, kernel 6.8.0-138-generic #138~22.04.1-Ubuntu
/proc/version_signature: Ubuntu 6.8.0-138.138~22.04.1-generic 6.8.12
DMI: MECHREVO M5 / H45 / BIOS J002NS4 (2023-08-23)
CPU: 12th Gen Intel Core i5-12450H (12 threads)
RAM: 15.4 GiB (2x8 GB DDR4, dual channel, no ECC)
cgroup v2 (unified) only, memory.max = max, swap = 2 GiB swapfile
CONFIG_MEMCG=y CONFIG_MEMCG_KMEM=y CONFIG_SWAP=y CONFIG_LRU_GEN=y
CONFIG_LRU_GEN_ENABLED=y CONFIG_LRU_GEN_WALKS_MMU=y
# CONFIG_DEBUG_VM is not set, # CONFIG_KASAN is not set
```
## The crashes
| # | When (local, CST) | RIP | Fault address | Process | MGLRU |
|---|---|---|---|---|---|
| 1 | 2026-10-11 15:34:55 | `lru_gen_add_folio+0x287/0x460` |
`0xdead000000000108` | Compositor | on |
| 1b | same boot | `__rmqueue_pcplist+0x52/0x2e0` | `0xdead000000000108` |
Chrome_ChildIOT | on |
| 2 | 2026-10-14 21:38:46 | `lru_gen_eviction+0xbb/0x1c0` |
`0xe89068b86349359` | kswapd0 | on |
| 3 | 2026-10-14 22:47:22 | `__lruvec_stat_mod_folio+0x57/0xc0` |
`0x37d000000000621` | ThreadPoolForeg | on |
| 4 | 2026-10-17 09:07:04 | `rmqueue_bulk+0x11b/0x780` | `0xdead000000000108`
| qoder | on |
| **5** | **2026-10-20 01:40:25** | **`uncharge_folio+0x189/0x230`** |
**`0xffff1323224727a0`** | **ThreadPoolForeg** | **off (0x0000)** |
Event 5, full trace in `03-evidence.txt`:
```
general protection fault, probably for non-canonical address
0xffff1323224727a0: 0000 [#1] PREEMPT SMP NOPTI
CPU: 6 PID: 26610 Comm: ThreadPoolForeg Not tainted 6.8.0-138-generic
RIP: 0010:uncharge_folio+0x189/0x230
Code: ... 49 8b 46 10 a8 03 75 6a <65> 48 ff 00 ...
RAX: ffff899072b727a0 R13: ffff898f4e2ecff8 R14: ffffe9fdcc35ab88
Call Trace:
__mem_cgroup_uncharge_list+0x62/0xb0
release_pages+0x13a/0x490
free_pages_and_swap_cache+0x4a/0x60
tlb_batch_pages_flush+0x43/0x80
tlb_flush_mmu+0x3a/0x120
zap_pte_range+0x707/0xc30
unmap_vmas+0xb5/0x190
exit_mmap+0x10a/0x3f0
mmput/exit_mm/do_exit
```
The faulting instruction is `incq %gs:(%rax)` — a per-CPU add through a
pointer taken
from the folio/memcg side, resolving to a non-canonical address.
**In the same second** (`mm/memcontrol.c:1460`):
```
mem_cgroup_update_lru_size(00000000c92e446b, 0, -1): lru_size -1
WARNING: CPU: 7 PID: 26540 Comm: Chrome_ChildIOT Tainted: G D
```
After the oops the task never released its RCU read-side section, so the box
spent the
next 35 minutes in a repeating `rcu_preempt detected stalls ... P26610`
cascade —
logind/dbus calls timed out, the desktop became unusable, and the machine had
to be
power-cycled.
Event 4 is the same family seen from the allocator side — 32 `BUG: Bad page
state`
reports in ~1 s, all for ext4 page-cache pages of one file, every one with
`page dumped because: page still charged to cgroup`, followed 37 ms later by
`rmqueue_bulk` walking a PCP list whose `next` pointer was `LIST_POISON1`.
## What has been excluded
* **RAM**: `memtest86+` from USB, **12 passes, 0 errors, 9 h 45 min** over
the full
15.4 GiB. (The same tool found a genuinely bad DIMM on this machine in Aug
2026 with
4 passes, so it is sensitive here.) No ECC, so this is the strongest
available check.
* **Disk**: NVMe SMART clean; ext4 `fsck` clean.
* **Applications**: the crashing processes are Chrome/Qoder/VS Code worker
threads, but
the bad pages belong to unrelated memory (e.g. a FITS file's page cache),
and the
same fault class hits `kswapd0` with no application involved.
* **MGLRU**: disabled for event 5, crash persisted.
## Reproduction attempts (negative)
Synthetic loads did **not** reproduce it:
* 900 sequential `app.slice` transient scopes, 48 MB shmem each → nothing
* 60 batches x 8 concurrent scopes x 256 MB (2 GB per batch) → nothing
* 8 GiB anonymous ballast (MemAvailable ~2 GiB) + 2657 scope churn cycles with
direct reclaim active (`pgscan_direct` 44k, `pswpout` ~33k pages) → nothing
Total ~3600 cgroup create/destroy cycles, zero warnings. The trigger appears
to need
real Chromium-family process behaviour (threads, i915 GEM buffers, shared
memory)
and/or many hours of uptime, not just memory pressure.
## Impact
Machine is unusable after each event (hard power-off required; this model has
no
battery, so every event is an unclean shutdown). 5 events in 9 days.
## What I can do to help
* Run any debug kernel / patch (KASAN, page_owner, debug_pagealloc) if you
tell me which one.
* Test a mainline kernel if that helps narrow it down.
* Provide full `pstore` dumps, journals and the reproduction scripts.
## Attachments
* `03-evidence.txt` — assembled bundle (system info, all five traces, MGLRU
evidence,
reproduction attempts)
* `journal_20261020_crash_excerpt.log` — 01:35–02:16 window covering event 5
and the
RCU stall cascade (273 KB). The full journal of that boot (2.3 MB) is
available on request.
* `journal_boot-5_20261014_crash.log`, `journal_boot-3_20261014_crash.log` —
events 2 and 3
* `pstore-179170409/`, `pstore-179198512/`, `pstore-179198924/`,
`pstore-179219922/`,
`pstore-179243162/` — EFI pstore dmesg dumps (each directory = one
oops/panic)
+ ---
+ ProblemType: Bug
+ ApportVersion: 2.20.11-0ubuntu82.10
+ Architecture: amd64
+ AudioDevicesInUse:
+ USER PID ACCESS COMMAND
+ /dev/snd/controlC0: ajst 2623 F.... pulseaudio
+ /dev/snd/controlC1: ajst 2623 F.... pulseaudio
+ CRDA: N/A
+ CasperMD5CheckResult: pass
+ CurrentDesktop: ubuntu:GNOME
+ DistroRelease: Ubuntu 22.04
+ InstallationDate: Installed on 2024-03-16 (948 days ago)
+ InstallationMedia: Ubuntu 22.04.4 LTS "Jammy Jellyfish" - Release amd64
(20240220)
+ MachineType: MECHREVO M5
+ Package: linux (not installed)
+ ProcFB: 0 i915drmfb
+ ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic
root=UUID=e7bc3822-7d1c-4573-8569-c0706eefb3ac ro quiet splash vt.handoff=7
+ ProcVersionSignature: Ubuntu 6.8.0-138.138~22.04.1-generic 6.8.12
+ RelatedPackageVersions:
+ linux-restricted-modules-6.8.0-138-generic N/A
+ linux-backports-modules-6.8.0-138-generic N/A
+ linux-firmware 20220329.git681281e4-0ubuntu3.42
+ Tags: jammy
+ Uname: Linux 6.8.0-138-generic x86_64
+ UpgradeStatus: No upgrade log present (probably fresh install)
+ UserGroups: adm cdrom dip lpadmin lxd plugdev sambashare sudo
+ _MarkForUpload: True
+ dmi.bios.date: 08/23/2023
+ dmi.bios.release: 5.27
+ dmi.bios.vendor: American Megatrends International, LLC.
+ dmi.bios.version: J002NS4
+ dmi.board.asset.tag: Default string
+ dmi.board.name: H45
+ dmi.board.vendor: MECHREVO
+ dmi.board.version: V1.0
+ dmi.chassis.asset.tag: Default string
+ dmi.chassis.type: 3
+ dmi.chassis.vendor: MECHREVO
+ dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrJ002NS4:bd08/23/2023:br5.27:svnMECHREVO:pnM5:pvr:rvnMECHREVO:rnH45:rvrV1.0:cvnMECHREVO:ct3:cvr:sku800046290:
+ dmi.product.family: WuJie
+ dmi.product.name: M5
+ dmi.product.sku: 800046290
+ dmi.sys.vendor: MECHREVO
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171572
Title:
mm/memcg: repeated general protection fault in uncharge_folio +
lru_size underflow on 6.8.0-138 (jammy HWE), independent of MGLRU
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171572/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
