CVE-2026-93197

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

memcg: move LRU size accounting on reparenting instead of copying it

When a memory cgroup is offlined its LRU folios are reparented to the

parent. lruvec_reparent_lru() splices the child's lists into the

parent's and credits the parent with the child's per-zone

lru_zone_size[], but never clears the child's copy, so the size is

copied rather than moved. lru_gen_reparent_memcg() does the same for

MGLRU.

The parent is left correct, credited with exactly the folios it took

over. The stale value sits on the child and nothing will correct it:

folio->memcg_data now resolves to the parent, so every later

update_lru_size() for those folios goes there.

Dying cgroups are not freed immediately and mem_cgroup_iter() still

walks them, so shrink_lruvec() keeps being called on them.

get_scan_count() reads the phantom counter through lruvec_lru_size() and

the scan loop then grinds through nr[] in SWAP_CLUSTER_MAX steps against

a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References