CVE-2026-93216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the

start to guard against tail pages and NULL data. However, it later

re-reads page->memcg_data locklessly in two places:

1: page_memcg_check(page)

2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes

VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)

If the page is concurrently freed and reallocated as a THP tail page or

slab page between these calls, the VM_BUG_ON assertions can trigger on

CONFIG_DEBUG_VM=y builds, crashing the kernel.

Fix both TOCTOU issues by using the memcg_data snapshot throughout.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References