CVE-2026-93197 (GCVE-0-2026-93197)
Vulnerability from cvelistv5 – Published: 2026-09-17 16:12 – Updated: 2026-09-17 16:12
VLAI
EPSS
VEX
Title
memcg: move LRU size accounting on reparenting instead of copying it
Summary
In the Linux kernel, the following vulnerability has been resolved:
memcg: move LRU size accounting on reparenting instead of copying it
When a memory cgroup is offlined its LRU folios are reparented to the
parent. lruvec_reparent_lru() splices the child's lists into the
parent's and credits the parent with the child's per-zone
lru_zone_size[], but never clears the child's copy, so the size is
copied rather than moved. lru_gen_reparent_memcg() does the same for
MGLRU.
The parent is left correct, credited with exactly the folios it took
over. The stale value sits on the child and nothing will correct it:
folio->memcg_data now resolves to the parent, so every later
update_lru_size() for those folios goes there.
Dying cgroups are not freed immediately and mem_cgroup_iter() still
walks them, so shrink_lruvec() keeps being called on them.
get_scan_count() reads the phantom counter through lruvec_lru_size() and
the scan loop then grinds through nr[] in SWAP_CLUSTER_MAX steps against
an empty list, for as long as the dead cgroup lives. Under MGLRU the
MGLRU scanner runs instead, but count_shadow_nodes() sums all of
NR_LRU_LISTS through lruvec_lru_size() and over-budgets the shadow node
limit just the same.
On one 251 GiB host a sweep of every mz->lru_zone_size[] found 380
counters describing folios on no list at all: 124777314 pages, 476 GiB,
1.89x the machine's RAM, across 57 cgroups. All were on memcgs with
CSS_DYING set and CSS_ONLINE clear, and parent/child pairs reported
byte-identical sizes.
LRU_UNEVICTABLE needs its size moved too. Its list is deliberately not
spliced because lruvec_init() poisons the head - the unevictable LRU is
imaginary and folios are never threaded on it - but the size is kept by
lruvec_add_folio()/lruvec_del_folio() and those folios account to the
parent from here on.
This depends on commit bf4ade7dbd76 ("memcg: keep folio's objcg same as
its node") and must not be backported ahead of it. Without that
invariant a folio's objcg can belong to another node, so a folio already
spliced onto the parent's list can still resolve to the child's lruvec
until the objcg's node is reparented in a later iteration of
memcg_reparent_objcgs(); clearing the child's counter early then lets
lruvec_del_folio() underflow it and trip the WARN_ONCE()/VM_BUG_ON() in
mem_cgroup_update_lru_size().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
07a6e9a2c199fed361f528781284d56771d0016f , < 007bc1842317bb99f5f6205afede940f951674c2
(git)
Affected: 07a6e9a2c199fed361f528781284d56771d0016f , < 0e0ac326c511d514817cc7b6d7741afd59098ce2 (git) |
guessed | |
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/folio.c",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "007bc1842317bb99f5f6205afede940f951674c2",
"status": "affected",
"version": "07a6e9a2c199fed361f528781284d56771d0016f",
"versionType": "git"
},
{
"lessThan": "0e0ac326c511d514817cc7b6d7741afd59098ce2",
"status": "affected",
"version": "07a6e9a2c199fed361f528781284d56771d0016f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/folio.c",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: move LRU size accounting on reparenting instead of copying it\n\nWhen a memory cgroup is offlined its LRU folios are reparented to the\nparent. lruvec_reparent_lru() splices the child\u0027s lists into the\nparent\u0027s and credits the parent with the child\u0027s per-zone\nlru_zone_size[], but never clears the child\u0027s copy, so the size is\ncopied rather than moved. lru_gen_reparent_memcg() does the same for\nMGLRU.\n\nThe parent is left correct, credited with exactly the folios it took\nover. The stale value sits on the child and nothing will correct it:\nfolio-\u003ememcg_data now resolves to the parent, so every later\nupdate_lru_size() for those folios goes there.\n\nDying cgroups are not freed immediately and mem_cgroup_iter() still\nwalks them, so shrink_lruvec() keeps being called on them.\nget_scan_count() reads the phantom counter through lruvec_lru_size() and\nthe scan loop then grinds through nr[] in SWAP_CLUSTER_MAX steps against\nan empty list, for as long as the dead cgroup lives. Under MGLRU the\nMGLRU scanner runs instead, but count_shadow_nodes() sums all of\nNR_LRU_LISTS through lruvec_lru_size() and over-budgets the shadow node\nlimit just the same.\n\nOn one 251 GiB host a sweep of every mz-\u003elru_zone_size[] found 380\ncounters describing folios on no list at all: 124777314 pages, 476 GiB,\n1.89x the machine\u0027s RAM, across 57 cgroups. All were on memcgs with\nCSS_DYING set and CSS_ONLINE clear, and parent/child pairs reported\nbyte-identical sizes.\n\nLRU_UNEVICTABLE needs its size moved too. Its list is deliberately not\nspliced because lruvec_init() poisons the head - the unevictable LRU is\nimaginary and folios are never threaded on it - but the size is kept by\nlruvec_add_folio()/lruvec_del_folio() and those folios account to the\nparent from here on.\n\nThis depends on commit bf4ade7dbd76 (\"memcg: keep folio\u0027s objcg same as\nits node\") and must not be backported ahead of it. Without that\ninvariant a folio\u0027s objcg can belong to another node, so a folio already\nspliced onto the parent\u0027s list can still resolve to the child\u0027s lruvec\nuntil the objcg\u0027s node is reparented in a later iteration of\nmemcg_reparent_objcgs(); clearing the child\u0027s counter early then lets\nlruvec_del_folio() underflow it and trip the WARN_ONCE()/VM_BUG_ON() in\nmem_cgroup_update_lru_size()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:12:19.776Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/007bc1842317bb99f5f6205afede940f951674c2"
},
{
"url": "https://git.kernel.org/stable/c/0e0ac326c511d514817cc7b6d7741afd59098ce2"
}
],
"title": "memcg: move LRU size accounting on reparenting instead of copying it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93197",
"datePublished": "2026-09-17T16:12:19.776Z",
"dateReserved": "2026-09-17T16:02:15.092Z",
"dateUpdated": "2026-09-17T16:12:19.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/folio.c",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "007bc1842317bb99f5f6205afede940f951674c2",
"status": "affected",
"version": "07a6e9a2c199fed361f528781284d56771d0016f",
"versionType": "git"
},
{
"lessThan": "0e0ac326c511d514817cc7b6d7741afd59098ce2",
"status": "affected",
"version": "07a6e9a2c199fed361f528781284d56771d0016f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/folio.c",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: move LRU size accounting on reparenting instead of copying it\n\nWhen a memory cgroup is offlined its LRU folios are reparented to the\nparent. lruvec_reparent_lru() splices the child\u0027s lists into the\nparent\u0027s and credits the parent with the child\u0027s per-zone\nlru_zone_size[], but never clears the child\u0027s copy, so the size is\ncopied rather than moved. lru_gen_reparent_memcg() does the same for\nMGLRU.\n\nThe parent is left correct, credited with exactly the folios it took\nover. The stale value sits on the child and nothing will correct it:\nfolio-\u003ememcg_data now resolves to the parent, so every later\nupdate_lru_size() for those folios goes there.\n\nDying cgroups are not freed immediately and mem_cgroup_iter() still\nwalks them, so shrink_lruvec() keeps being called on them.\nget_scan_count() reads the phantom counter through lruvec_lru_size() and\nthe scan loop then grinds through nr[] in SWAP_CLUSTER_MAX steps against\nan empty list, for as long as the dead cgroup lives. Under MGLRU the\nMGLRU scanner runs instead, but count_shadow_nodes() sums all of\nNR_LRU_LISTS through lruvec_lru_size() and over-budgets the shadow node\nlimit just the same.\n\nOn one 251 GiB host a sweep of every mz-\u003elru_zone_size[] found 380\ncounters describing folios on no list at all: 124777314 pages, 476 GiB,\n1.89x the machine\u0027s RAM, across 57 cgroups. All were on memcgs with\nCSS_DYING set and CSS_ONLINE clear, and parent/child pairs reported\nbyte-identical sizes.\n\nLRU_UNEVICTABLE needs its size moved too. Its list is deliberately not\nspliced because lruvec_init() poisons the head - the unevictable LRU is\nimaginary and folios are never threaded on it - but the size is kept by\nlruvec_add_folio()/lruvec_del_folio() and those folios account to the\nparent from here on.\n\nThis depends on commit bf4ade7dbd76 (\"memcg: keep folio\u0027s objcg same as\nits node\") and must not be backported ahead of it. Without that\ninvariant a folio\u0027s objcg can belong to another node, so a folio already\nspliced onto the parent\u0027s list can still resolve to the child\u0027s lruvec\nuntil the objcg\u0027s node is reparented in a later iteration of\nmemcg_reparent_objcgs(); clearing the child\u0027s counter early then lets\nlruvec_del_folio() underflow it and trip the WARN_ONCE()/VM_BUG_ON() in\nmem_cgroup_update_lru_size()."
}
],
"id": "CVE-2026-93197",
"lastModified": "2026-09-17T17:18:15.990",
"metrics": {},
"published": "2026-09-17T17:18:15.990",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/007bc1842317bb99f5f6205afede940f951674c2"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0e0ac326c511d514817cc7b6d7741afd59098ce2"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"suse_vex": {
"aggregate_severity": "not set",
"current_release_date": "2026-09-18T00:10:49Z",
"cve": "CVE-2026-93197",
"id": "CVE-2026-93197",
"initial_release_date": "2026-09-18T00:10:49Z",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-93197",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93197.json",
"version": "2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…