CVE-2026-98414

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

memcg: avoid charging the root memcg from obj_cgroup_charge_pages()

obj_cgroup_charge_pages() resolves the objcg to its memcg and calls

try_charge_memcg(), which does not short circuit the root memcg. That

memcg can be the root memcg: obj_cgroup_is_root() reflects the memcg the

objcg was created for and is never updated, while memcg_reparent_objcgs()

does redirect objcg->memcg to the parent on rmdir. An objcg of a dying

child of root therefore passes every obj_cgroup_is_root() filter but

resolves to the root memcg.

Folios keep the objcg they were charged with, so this is easy to reach

through zswap: allocate anon memory in a cgroup, move the task out, remove

the cgroup, then write to the root cgroup's memory.reclaim. The reclaimed

folios are charged through the reparented objcg and end up in

refill_stock() with the root memcg:

WARNING: mm/memcontrol.c:2198 at refill_stock+0x644/0x940

refill_stock+0x644/0x94

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References