CVE-2026-98225

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem

With cgroup.memory=nokmem, shrinker_memcg_alloc() bails out early and

never allocates an id, so shrinker->id keeps the 0 it got from the

kzalloc() in shrinker_alloc(). __list_lru_init() then copies that 0 into

lru->shrinker_id, where it looks like a valid bit index.

Nothing calls expand_shrinker_info() on nokmem either, so shrinker_nr_max

stays 0 and every memcg ends up with an empty map (map_nr_max == 0).

deferred_split_folio() hands a real memcg to __list_lru_add() regardless

of whether the lru is memcg aware, so the first THP queued in a cgroup

does set_shrinker_bit(memcg, nid, 0) and trips the bounds check:

WARNING: mm/shrinker.c:212 at set_shrinker_bit+0x7d/0x90, CPU#126

Call Trace:

<TASK>

deferred_split_folio+0x18c/0x220

map_anon_folio_pmd_nopf+0xdd/0x130

map_anon_folio_pmd_pf+0x14/0xb0

do_huge_pmd_anonymous_page+0x1a1/0x620

__handle_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References