FKIE_CVE-2026-98225

Vulnerability from fkie_nvd - Published: 2026-10-06 09:18 - Updated: 2026-10-06 09:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinker_memcg_alloc() bails out early and never allocates an id, so shrinker->id keeps the 0 it got from the kzalloc() in shrinker_alloc(). __list_lru_init() then copies that 0 into lru->shrinker_id, where it looks like a valid bit index. Nothing calls expand_shrinker_info() on nokmem either, so shrinker_nr_max stays 0 and every memcg ends up with an empty map (map_nr_max == 0). deferred_split_folio() hands a real memcg to __list_lru_add() regardless of whether the lru is memcg aware, so the first THP queued in a cgroup does set_shrinker_bit(memcg, nid, 0) and trips the bounds check: WARNING: mm/shrinker.c:212 at set_shrinker_bit+0x7d/0x90, CPU#126 Call Trace: <TASK> deferred_split_folio+0x18c/0x220 map_anon_folio_pmd_nopf+0xdd/0x130 map_anon_folio_pmd_pf+0x14/0xb0 do_huge_pmd_anonymous_page+0x1a1/0x620 __handle_mm_fault+0xea9/0x10d0 handle_mm_fault+0xe5/0x320 do_user_addr_fault+0x1cc/0x870 exc_page_fault+0x81/0x1b0 asm_exc_page_fault+0x27/0x30 </TASK> Harmless, the WARN_ON_ONCE() is what keeps the out of bounds unit[] read from happening, but the id should not look valid in the first place. Clear it before returning. Two other spots could paper over this: drop the id in __list_lru_init() when nokmem turns memcg_aware off, or make deferred_split_folio() pass NULL like list_lru_add_obj() does. Both leave shrinker->id lying around for the next caller, so fix it where the id is handed out.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/469c12a69ab1842a9090b6c074ffedbfd9584f9c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/932cfb25e7ce98d1f93895671ec186a3087e4f80
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "469c12a69ab1842a9090b6c074ffedbfd9584f9c",
              "status": "affected",
              "version": "fafaeceb89a5e2e856ff04c2cacb6cae4a2ecb67",
              "versionType": "git"
            },
            {
              "lessThan": "932cfb25e7ce98d1f93895671ec186a3087e4f80",
              "status": "affected",
              "version": "fafaeceb89a5e2e856ff04c2cacb6cae4a2ecb67",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem\n\nWith cgroup.memory=nokmem, shrinker_memcg_alloc() bails out early and\nnever allocates an id, so shrinker-\u003eid keeps the 0 it got from the\nkzalloc() in shrinker_alloc().  __list_lru_init() then copies that 0 into\nlru-\u003eshrinker_id, where it looks like a valid bit index.\n\nNothing calls expand_shrinker_info() on nokmem either, so shrinker_nr_max\nstays 0 and every memcg ends up with an empty map (map_nr_max == 0).\n\ndeferred_split_folio() hands a real memcg to __list_lru_add() regardless\nof whether the lru is memcg aware, so the first THP queued in a cgroup\ndoes set_shrinker_bit(memcg, nid, 0) and trips the bounds check:\n\nWARNING: mm/shrinker.c:212 at set_shrinker_bit+0x7d/0x90, CPU#126\nCall Trace:\n \u003cTASK\u003e\n deferred_split_folio+0x18c/0x220\n map_anon_folio_pmd_nopf+0xdd/0x130\n map_anon_folio_pmd_pf+0x14/0xb0\n do_huge_pmd_anonymous_page+0x1a1/0x620\n __handle_mm_fault+0xea9/0x10d0\n handle_mm_fault+0xe5/0x320\n do_user_addr_fault+0x1cc/0x870\n exc_page_fault+0x81/0x1b0\n asm_exc_page_fault+0x27/0x30\n \u003c/TASK\u003e\n\nHarmless, the WARN_ON_ONCE() is what keeps the out of bounds unit[] read\nfrom happening, but the id should not look valid in the first place. \nClear it before returning.\n\nTwo other spots could paper over this: drop the id in __list_lru_init()\nwhen nokmem turns memcg_aware off, or make deferred_split_folio() pass\nNULL like list_lru_add_obj() does.  Both leave shrinker-\u003eid lying around\nfor the next caller, so fix it where the id is handed out."
    }
  ],
  "id": "CVE-2026-98225",
  "lastModified": "2026-10-06T09:18:09.587",
  "metrics": {},
  "published": "2026-10-06T09:18:09.587",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/469c12a69ab1842a9090b6c074ffedbfd9584f9c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/932cfb25e7ce98d1f93895671ec186a3087e4f80"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.