CVE-2026-98223

What it actually does

Race condition in Linux kernel filemap handling allows mapped dropbehind folios to trigger folio_unmap_invalidate() calling unmap_mapping_folio() under i_mmap_rwsem in non-preemptible task context, producing sleeping-in-atomic warnings.

Why it matters to the business

Linux systems may experience kernel warnings or instability during memory and file I/O workloads, reducing reliability and requiring unplanned reboots or patches.

How an attack unfolds

An attacker triggers fault-around mapping of ready dropbehind folios followed by writeback completion that invokes the unmap path without page-cache lookup clearing dropbehind state, but no public exploits or threat actors are known.

How to fix it

Apply upstream kernel patches that retain mapped dropbehind folios instead of forcibly unmapping them; rebuild and deploy updated kernel images across affected distributions.

How to confirm the fix worked

Boot patched kernel and exercise file mapping plus writeback workloads while monitoring dmesg for absence of sleeping-in-atomic warnings referencing folio_unmap_invalidate or filemap.

Typical attack path

1. Map file pages to establish competing cached user
2. Mark folios for dropbehind
3. Initiate writeback while holding non-preemptible context
4. Trigger folio_end_dropbehind to call unmap_mapping_folio under atomic constraints

How to detect it

Search kernel logs and dmesg for sleeping-in-atomic or WARNING messages containing folio_unmap_invalidate, filemap, or dropbehind; correlate with processes performing mmap and writeback.

What your security team should do

• Prioritize kernel updates in next maintenance window given 17-day publication window
• Add kernel log monitoring for folio-related atomic sleep warnings
• Test memory-pressure and file-I/O workloads in staging before production rollout