Executive brief
The Linux kernel's memory cgroup (memcg) subsystem contains a race condition that occurs when memory pages (folios) are migrated across NUMA nodes. During migration, a folio's memory control group reference becomes misaligned with its actual node location, causing subsequent memory management operations to access incorrect lock structures. This can lead to memory corruption, data loss, or denial of service.
Technical details
The vulnerability is a race condition in the memcg memory accounting subsystem affecting folio migration across NUMA nodes. The root cause is that memcg_reparent_objcgs() assumes a folio's objcg (object cgroup) matches its node's objcg, but folio migration breaks this invariant—the folio inherits the old objcg while residing on a different node. Since objcg reparenting and LRU list reparenting operate on different nodes with lock releases in between, a window exists where LRU operations resolve lruvec through a stale objcg and acquire the wrong lru_lock. The fix selects objcg by folio_nid() at charge time and re-derives it during migration in mem_cgroup_migrate() and mem_cgroup_replace_folio(). Network attack vector is not applicable; exploitation requires local system access or specific memory management workloads triggering folio migration. Patch available in Linux kernel mainline and stable branches.
Affected products
- Linux Linux kernel multiple versions (see stable branches linux-5.10.y through linux-7.2.y and mainline)
Timeline
- 2026-09-16: disclosed
- 2026-08-13: patched: Fix commit bf4ade7dbd76d4ec8697840e4ebb15ed77c5ec26 merged to mainline; backported to stable branches
- 2026-08-07: other: Fix originally submitted by Shakeel Butt