{"metadata": {"vulnerability": "CVE-2026-98414", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.347Z", "date_only": false, "value": "2026-09-25T10:25:14.347Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98414", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98414", "record": "UBUNTU-CVE-2026-98414", "field": "published"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98414", "record": "UBUNTU-CVE-2026-98414", "field": "modified"}, {"timestamp": "2026-10-14T13:27:46.003Z", "date_only": false, "value": "2026-10-14T13:27:46.003Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98414", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:52Z", "date_only": false, "value": "2026-10-14T14:17:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5RPH-2X3F-GV5R", "record": "GHSA-5RPH-2X3F-GV5R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T14:17:52.673Z", "date_only": false, "value": "2026-10-14T14:17:52.673", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98414", "record": "FKIE_CVE-2026-98414", "field": "published"}, {"timestamp": "2026-10-14T15:32:21Z", "date_only": false, "value": "2026-10-14T15:32:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5RPH-2X3F-GV5R", "record": "GHSA-5RPH-2X3F-GV5R", "field": "published"}, {"timestamp": "2026-10-14T15:32:21Z", "date_only": false, "value": "2026-10-14T15:32:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5RPH-2X3F-GV5R", "record": "GHSA-5RPH-2X3F-GV5R", "field": "modified"}, {"timestamp": "2026-10-14T18:41:35.272Z", "date_only": false, "value": "2026-10-14T18:41:35.272540Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440727926371921", "record": "CVE-2026-98414", "field": "creation_timestamp", "uuid": "54bfccec-f200-4caf-9caf-14d76b0a192d", "content": "CVE-2026-98414 memcg: avoid charging the root memcg from obj_cgroup_charge_pages() In the Linux kernel, the following vulnerability has been resolved:\nmemcg: avoid charging the root memcg from obj_cgroup_charge_pages()\nobj_cgroup_charge_pages() resolves the objcg to its memcg and callstry_charge_memcg(), which does not short circuit the root memcg.  Thatmemcg can be the root memcg: obj_cgroup_is_root() reflects the memcg theobjcg was created for and is never updated, while memcg_reparent_objcgs()does redirect objcg->memcg to the parent on rmdir.  An objcg of a dyingchild of root therefore passes every obj_cgroup_is_root() filter butresolves to the root memcg.\nFolios keep the objcg they were charged with, so this is easy to reachthrough zswap: allocate anon memory in a cgroup, move the task out, removethe cgroup, then write to the root cgroup's memory.reclaim.  The reclaimedfolios are charged through the reparented objcg and end up inrefill_stock() with the root memcg:\n  WARNING: mm/memcontrol.c:2198 at refill_stock+0x644/0x940   refill_stock+0x644/0x940   try_charge_memcg+0x12d6/0x1570   __obj_cgroup_charge+0x35/0xf0   obj_cgroup_charge+0x1de/0x210   obj_cgroup_charge_zswap+0x83/0x270   zswap_store+0x1620/0x2000   swap_writeout+0x94c/0x14c0   shrink_folio_list+0x3388/0x52b0   [...]   try_to_free_mem_cgroup_pages+0x30d/0x830   user_proactive_reclaim+0x504/0x840   memory_reclaim+0x1f/0x30\nBeyond the warning, the charge is asymmetric: obj_cgroup_uncharge_pages()skips refill_stock() for the root memcg, so the root's page counter growsand is never uncharged.  It is not user visible, since memory.current isnot exposed on the root, but it is a leak.\nUse try_charge(), which returns early for the root memcg, restoring thesymmetry with obj_cgroup_uncharge_pages().\nThe above sequence was scripted into a standalone reproducer (zswap on,swap on a virtio disk, 512MB of anon memory faulted in inside a child ofthe root cgroup, the task then migrated to the root cgroup, the childremoved, followed by \"echo 600M swappiness=max > memory.reclaim\" on theroot) and run in a CONFIG_DEBUG_VM=y VM.  It reproduces the splat on thefirst zswap store of a reparented folio, with the same call chain as thereport.  With this patch applied the splat is gone while the zswap storecount over the run is unchanged, so the same path is still exercised. cgroup selftests test_zswap, test_kmem and test_memcontrol show no newfailures.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98414https://git.kernel.org/stable/c/d5cdff14c385bf42d03c0dd4c3e88ddf4c28b8a9https://git.kernel.org/stable/c/ecc03877b1b05cb1e3a72175ccb868383eccc518https://git.kernel.org/stable/c/6e673d0879ef78c395cfe0d3ba316690a60055d8#kernel #Linux#CVE_2026_98414#bot", "url": "https://infosec.exchange/users/cve/statuses/117440727926371921"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-17T06:05:41.219Z", "date_only": false, "value": "2026-10-17T06:05:41.21921Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98414", "record": "BELL-CVE-2026-98414", "field": "published"}, {"timestamp": "2026-10-17T06:20:29.913Z", "date_only": false, "value": "2026-10-17T06:20:29.913749Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98414", "record": "BELL-CVE-2026-98414", "field": "modified"}, {"timestamp": "2026-10-18T10:27:42Z", "date_only": false, "value": "2026-10-18T10:27:42Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-18T10:27:42Z", "date_only": false, "value": "2026-10-18T10:27:42Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-19T09:19:08.193Z", "date_only": false, "value": "2026-10-19T09:19:08.193Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98414", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T09:19:08.193Z", "date_only": false, "value": "2026-10-19T09:19:08.193Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98414", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:18:46.707Z", "date_only": false, "value": "2026-10-19T10:18:46.707", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98414", "record": "FKIE_CVE-2026-98414", "field": "lastModified"}]}