CVE-2026-93216
Description
In the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places: 1: page_memcg_check(page) 2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS) If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM_BUG_ON assertions can trigger on CONFIG_DEBUG_VM=y builds, crashing the kernel. Fix both TOCTOU issues by using the memcg_data snapshot throughout.
How to fix
- Linux Linuxe7c1923c5f30a6953f0540e3171d882ec17b05d3, a4c940ab3f794f221a338c9431ad1ce0d73a2bea, 46761406e14381dc35f498c247a87565b87ea2ef, 90f095b816e25c6a9e4446d299bac5007fdcb3df or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | fcf8935832b86d3437f00e732c6d0d4d2819d6a9 ≤ v < e7c1923c5f30a6953f0540e3171d882ec17b05d3, fcf8935832b86d3437f00e732c6d0d4d2819d6a9 ≤ v < a4c940ab3f794f221a338c9431ad1ce0d73a2bea, fcf8935832b86d3437f00e732c6d0d4d2819d6a9 ≤ v < 46761406e14381dc35f498c247a87565b87ea2ef, fcf8935832b86d3437f00e732c6d0d4d2819d6a9 ≤ v < 90f095b816e25c6a9e4446d299bac5007fdcb3df, 5.18 | e7c1923c5f30a6953f0540e3171d882ec17b05d3, a4c940ab3f794f221a338c9431ad1ce0d73a2bea, 46761406e14381dc35f498c247a87565b87ea2ef, 90f095b816e25c6a9e4446d299bac5007fdcb3df |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.