EUVD-2026-80593
GHSA-5r45-xw38-xrg8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged trigger (AV:L/PR:L); tight NUMA-migration-vs-reparent race is AC:H; no data disclosure (C:N); LRU corruption gives I:L and A:H via kernel instability/DoS.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
memcg: keep folio's objcg same as its node
memcg_reparent_objcgs() has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits the old folio's objcg while living on a different node.
Once the assumption is broken, the reparenting of the folio's objcg and the reparenting of the folio's LRU list are no longer atomic. memcg_reparent_objcgs() handles one node per iteration and drops all the locks in between, so the objcg gets reparented in the iteration for the objcg's node while the LRU list gets spliced in the iteration for the folio's node. Any LRU operation on that folio in between resolves its lruvec through the objcg, and thus takes the lru_lock of the wrong memcg, not the lru_lock of the list the folio is actually on.
Fix this by selecting the objcg by folio_nid() at charge time, and by re-deriving it for the destination node in mem_cgroup_migrate() and mem_cgroup_replace_folio().
AnalysisAI
Cross-node folio migration in the Linux kernel 7.1 memory cgroup controller can leave a folio's objcg pointing at a different node than the LRU list the folio actually belongs to, so memcg reparenting resolves the wrong lruvec and takes the wrong lru_lock, corrupting memory-cgroup accounting and risking kernel failure (assessed availability impact High, integrity Low, confidentiality None). Exposure is narrow: it requires the memory controller active (default in modern container/systemd deployments), genuinely multi-node NUMA hardware, local authenticated access (CVSS vector PR:L) to trigger cross-node migration, and a race with memcg_reparent_objcgs() during cgroup offline in the non-atomic window between objcg and LRU-splicing iterations; single-node systems and kernels before 7.1 are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a running Linux 7.1 kernel with the memory cgroup controller active (default in modern container/systemd deployments) AND a multi-node NUMA system where folios migrate across nodes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) materially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 7.2.5 or 7.3-rc1, which contain the fix commits bf4ade7dbd76d4ec8697840e4ebb15ed77c5ec26 (7.2.5) and 6165478eaa3094eaee1d5e33b12520064faf043d (7.3-rc1) respectively, both available from https://git.kernel.org/stable/c/bf4ade7dbd76d4ec8697840e4ebb15ed77c5ec26 and https://git.kernel.org/stable/c/6165478eaa3094eaee1d5e33b12520064faf043d; distributions should backport these commits rather than waiting for the next rebase. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts running kernel 7.1.x, prioritizing multi-node NUMA systems with the memory cgroup controller enabled (typical in container and systemd deployments), and confirm whether they are exposed to locally authenticated users who could trigger cross-node folio migration; where immediate patching is not possible, restrict local login access to trusted administrators on those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today