[WSL2] Kernel panic in kswapd0 / move_folios_to_lru: list_add corruption on 6.18.33.2

[spacelan]

Windows Subsystem for Linux

WSL Version

2.7.11

WSL Kernel Version

6.18.33.2-2

Windows Version

Windows 11 25H2, build 26200.8655

Steps to Reproduce

1. Start WSL2 with an Ubuntu 24.04 distribution.
2. Run a memory-intensive workload that allocates many GB of anonymous memory in short pulses (e.g. DuckDB analytical queries, large pandas/numpy operations, heavy compilation).
3. After some time (seconds to tens of minutes depending on allocation intensity), the VM crashes.
4. The distro becomes unresponsive; wsl --shutdown is required to recover. Sometimes the WSL service / vmcompute must be restarted.

Expected Behavior

The workload should either complete successfully or trigger an OOM kill inside the guest. It should not kernel-panic the entire WSL2 VM.

Actual Behavior

The WSL2 utility VM kernel panics. Hyper-V logs Event ID 18590 with all-zero error codes. The guest message shows a kernel panic in kswapd0:

[ 1857.924430] list_add corruption. next->prev should be prev (ffff8ce089ffec30), but was ffff8ce089ffecec. (next=fffff7ea0bdb9bc8).
[ 1857.925349] ------------[ cut here ]------------
[ 1857.925350] kernel BUG at lib/list_debug.c:29!
[ 1857.925519] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 1857.925648] CPU: 22 UID: 0 PID: 228 Comm: kswapd0 Not tainted 6.18.33.2-microsoft-standard-WSL2 #1 PREEMPT(none)
[ 1857.925887] RIP: 0010:__list_add_valid_or_report+0x7f/0xc0
...
[ 1857.932237] Call Trace:
[ 1857.932394]  <TASK>
[ 1857.932506]  move_folios_to_lru+0x206/0x3f0
[ 1857.932775]  ? mod_memcg_lruvec_state+0xc6/0x1d0
[ 1857.933118]  ? __mod_lruvec_state+0x3a/0x50
[ 1857.933275]  ? isolate_lru_folios+0x38f/0x450
[ 1857.933453]  shrink_lruvec+0x820/0xdc0
[ 1857.933654]  shrink_node+0x31b/0x890
[ 1857.933839]  ? shrink_node+0x31b/0x890
[ 1857.934020]  balance_pgdat+0x357/0x7c0
[ 1857.934197]  kswapd+0x1cb/0x340
[ 1857.934329]  ? __pfx_autoremove_wake_function+0x10/0x10
[ 1857.934496]  ? __pfx_kswapd+0x10/0x10
[ 1857.934631]  kthread+0x111/0x240
[ 1857.934773]  ? __pfx_kthread+0x10/0x10
[ 1857.935049]  ret_from_fork+0x13c/0x1a0
[ 1857.935197]  ? __pfx_kthread+0x10/0x10
[ 1857.935352]  ret_from_fork_asm+0x1a/0x30
[ 1857.935442] Modules linked in: tls intel_rapl_msr intel_rapl_common sch_fq_codel autofs4 br_netfilter bridge stp llc ip_tables tun
[ 1857.935950] ---[ end trace 0000000000000000 ]---
[ 1857.939569] Kernel panic - not syncing: Fatal exception
[ 1858.970593] Shutting down cpus with NMI

This exact panic has been observed 8 times over 5 days under the same workload pattern, always with the same call trace.

Additional Context

• Host CPU: Intel Core i7-14700KF
• Host RAM: 48 GB DDR5-6800
• .wslconfig:

  [wsl2]
  memory=32G
  swap=32G
  guiApplications=false
  firewall=false
  nestedVirtualization=false
  networkingMode=mirrored

• Workaround attempted: limiting the application-level memory allocator (DuckDB) to 16 GB reduced the crash rate from ~50% to ~20% per run, but did not eliminate the panic.
• Host memory tests (MemTest86) and CPU stress tests (Prime95) pass; the panic is reproducible only inside the WSL2 VM under heavy anonymous-memory allocation pressure.

Request

Please investigate this kswapd0 / LRU-list corruption panic in the WSL2 6.18.33.2 kernel. Logs have been collected and will be attached below.

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[spacelan]

@wsl-team Here are the key details from the collected logs. The full .tar.gz is available if needed, but the panic is consistent across all crashes.

Environment

• WSL: 2.7.11
• WSL kernel: 6.18.33.2-microsoft-standard-WSL2
• Windows: 11 25H2 build 26200.8655
• CPU: Intel Core i7-14700KF
• RAM: 48 GB DDR5-6800
• .wslconfig:

  [wsl2]
  memory=32G
  swap=32G
  guiApplications=false
  firewall=false
  nestedVirtualization=false
  networkingMode=mirrored

All observed crashes (last 5 days)

All 8 events are Microsoft-Windows-Hyper-V-Worker-Admin ID 18590 with the same kswapd0 panic:

Time (local)	Seconds to panic	CPU
2026-07-23 23:13:35	~5608	21
2026-07-24 00:58:22	~412	21
2026-07-24 01:57:31	~1940	18
2026-07-24 02:18:14	~1239	18
2026-07-24 02:42:21	~1437	6
2026-07-24 12:40:44	~1202	14
2026-07-24 15:56:08	~71	27
2026-07-28 18:38:56	~1857	22

Representative panic (2026-07-28 18:38:56)

[ 1857.924430] list_add corruption. next->prev should be prev (ffff8ce089ffec30), but was ffff8ce089ffecec. (next=fffff7ea0bdb9bc8).
[ 1857.925350] kernel BUG at lib/list_debug.c:29!
[ 1857.925519] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 1857.925648] CPU: 22 UID: 0 PID: 228 Comm: kswapd0 Not tainted 6.18.33.2-microsoft-standard-WSL2 #1 PREEMPT(none)
[ 1857.925887] RIP: 0010:__list_add_valid_or_report+0x7f/0xc0
...
Call Trace:
 move_folios_to_lru+0x206/0x3f0
 shrink_lruvec+0x820/0xdc0
 shrink_node+0x31b/0x890
 balance_pgdat+0x357/0x7c0
 kswapd+0x1cb/0x340
 kthread+0x111/0x240
 ret_from_fork+0x13c/0x1a0
...
[ 1857.939569] Kernel panic - not syncing: Fatal exception
[ 1858.970593] Shutting down cpus with NMI

Observations

• The panic always occurs in kswapd0 during LRU list manipulation (move_folios_to_lru).
• Trigger: heavy anonymous-memory allocation pulses inside the WSL2 VM (e.g. DuckDB analytical workload).
• The guest has 32 GB RAM + 32 GB swap, but swap usage stays near zero at crash time; the issue is allocation rate vs. reclaim, not total capacity.
• Reducing the application memory limit from 30 GB to 16 GB dropped crash rate from ~50% to ~20% per run, but did not eliminate it.
• Host memory tests (MemTest86) and CPU stress tests (Prime95) pass.

Let me know if a full collect-wsl-logs.ps1 bundle captured during an actual panic is needed.

[OneBlue]

@chessturo: Do you think this is a kernel issue or a hardware issue ?