Executive brief
The Linux kernel's memory control group (cgroup) system manages memory allocation limits for containers and workloads. A flaw in the reclaim logic can cause a process to become stuck in an infinite loop and repeatedly trigger out-of-memory (OOM) events when memory limits are changed concurrently by multiple operations. This can degrade system responsiveness and generate spurious OOM notifications.
Technical details
The vulnerability exists in the memory.high and memory.max write handlers in mm/memcontrol.c. When separate file handles update the same memory limit concurrently, kernfs serialization is insufficient—each handler stores its target limit and begins synchronous reclaim, but continues using its local copy of the target in the reclaim loop. If another writer raises or removes the limit, the first writer compares stale target values against current usage, potentially looping indefinitely. For memory.max, once reclaim retries are exhausted, the OOM path sees sufficient margin under the current limit and does not kill processes, while the writer still records OOM events against its obsolete target. The patch adds a READ_ONCE check at the start of each reclaim iteration to detect if the current limit no longer matches the writer's target, causing early exit. This is a local logic flaw requiring no network access; no authentication bypass or privilege escalation is involved.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (stable branches affected)
Timeline
- 2026-09-11: disclosed: CVE-2026-89752 published
- 2026-09-07: patched: Patch merged by Greg Kroah-Hartman (commit 39ec1e4183a718f448b2e9de681dcbdda18fce42 and 4ea0617b9e46d26c0a3e5af00308ea1931cc545d)
- 2026-07-24: other: Initial patch submission by Guopeng Zhang