Executive brief
A vulnerability was identified in the Linux kernel's memory management component (memcg) that could lead to system instability or data corruption. The issue occurs when the system attempts to manage memory limits during high-priority hardware interrupts, potentially interfering with the system's random number generator. This could result in internal state corruption within the kernel, affecting the reliability of the operating system.
Technical details
A race condition exists in the Linux kernel's memory control group (memcg) subsystem within the refill_stock function. The function previously called get_random_u32_below() to select a victim for charge draining; however, this random subsystem call is neither reentrant nor NMI-safe as it acquires a per-cpu local_lock. If a Non-Maskable Interrupt (NMI) occurs during a ChaCha batch state update and recurses into the random subsystem, it can corrupt the internal state. The fix replaces the random selection with a per-cpu round-robin counter (drain_idx) serialized by the existing local_trylock in memcg_stock_pcp.
Affected products
- Linux Linux Kernel 6.16 to 6.18.36, 7.0.13
Timeline
- 2026-05-21: disclosed: Vulnerability reported by Harry Yoo
- 2026-06-19: patched: Patched in stable branches by Greg Kroah-Hartman
- 2026-06-25: advisory: CVE-2026-53162 published