CVE-2026-80729

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: initialise workingset state before folio split

xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but

__folio_split() leaves the xa_state's xa_lru unset. That lets a live,

memcg-charged xa_node exist without being linked into the mapping's

shadow_nodes list_lru; when reclaim later walks the list_lru it trips

VM_WARN_ON(!css_is_dying()).

Use mapping_set_update() to install both the workingset update callback

and the shadow_nodes list_lru on the xa_state.