{"schema":"threatline.record/2","record":{"id":"CVE-2026-93216","aliases":[],"summary":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()\n\nprint_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the\nstart to guard against tail pages and NULL data.  However, it later\nre-reads page->memcg_data locklessly in two places:\n\n1: page_memcg_check(page)\n\n2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes\n   VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)\n\nIf the page is concurrently freed and reallocated as a THP tail page or\nslab page between these calls, the VM_BUG_ON assertions can trigger on\nCONFIG_DEBUG_VM=y builds, crashing the kernel.\n\nFix both TOCTOU issues by using the memcg_data snapshot throughout.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_modified_at":"2026-10-21T12:52:21.777Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"e7c1923c5f30a6953f0540e3171d882ec17b05d3","status":"affected","versionType":"git"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"a4c940ab3f794f221a338c9431ad1ce0d73a2bea","status":"affected","versionType":"git"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"46761406e14381dc35f498c247a87565b87ea2ef","status":"affected","versionType":"git"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"90f095b816e25c6a9e4446d299bac5007fdcb3df","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_modified_at":"2026-10-21T12:52:21.777Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_modified_at":"2026-10-21T12:52:21.777Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"46761406e14381dc35f498c247a87565b87ea2ef","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_modified_at":"2026-10-21T12:52:21.777Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"90f095b816e25c6a9e4446d299bac5007fdcb3df","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05731,"score_date":"2026-10-23"},"published_at":"2026-09-24T15:10:38.702Z","modified_at":"2026-10-21T12:52:21.777Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:52:21.777Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93216","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/e7c1923c5f30a6953f0540e3171d882ec17b05d3"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a4c940ab3f794f221a338c9431ad1ce0d73a2bea"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/46761406e14381dc35f498c247a87565b87ea2ef"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:52:21.777Z","content_hash":"111977758e7c40d04ad8ca13da3b656ca7fe15de5b91dae6c11d9adec22f39c4"}}