All vulnerabilities
CVE-2026-93216

Linux: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in46761406e14381dc35f498c247a87565b87ea2efAlso 90f095b816e25c6a9e4446d299bac5007fdcb3dfCVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 46761406e14381dc35f498c247a87565b87ea2efLinuxCVE List
  • 90f095b816e25c6a9e4446d299bac5007fdcb3dfLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places:

1: page_memcg_check(page)

2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)

If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM_BUG_ON assertions can trigger on CONFIG_DEBUG_VM=y builds, crashing the kernel.

Fix both TOCTOU issues by using the memcg_data snapshot throughout.

Text from CVE List

Affected versions 10

  • Linuxaffected: fcf8935832b86d3437f00e732c6d0d4d2819d6a9 before e7c1923c5f30a6953f0540e3171d882ec17b05d3CVE List
  • Linuxaffected: fcf8935832b86d3437f00e732c6d0d4d2819d6a9 before a4c940ab3f794f221a338c9431ad1ce0d73a2beaCVE List
  • Linuxaffected: fcf8935832b86d3437f00e732c6d0d4d2819d6a9 before 46761406e14381dc35f498c247a87565b87ea2efCVE List
  • Linuxaffected: fcf8935832b86d3437f00e732c6d0d4d2819d6a9 before 90f095b816e25c6a9e4446d299bac5007fdcb3dfCVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 7.2.4 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4