CVE-2026-53162

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

memcg: use round-robin victim selection in refill_stock

Harry Yoo reported that get_random_u32_below() is not safe to call in the

nmi context and memcg charge draining can happen in nmi context.

More specifically get_random_u32_below() is neither reentrant- nor

NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave() on the

batched_entropy_u32 state. An NMI that lands on a CPU mid-update of the

ChaCha batch state and recurses into the random subsystem would corrupt

that state. The memcg_stock local_trylock prevents re-entry on the percpu

stock itself, but cannot protect an unrelated subsystem's per-cpu lock.

Replace the random pick with a per-cpu round-robin counter stored in

memcg_stock_pcp and serialized by the same local_trylock that already

guards cached[] and nr_pages[]. No atomics, no random calls, no extra

locks needed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References