CVE-2026-93240 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems should assess their exposure to CVE-2026-93240 and verify applied fixes. This includes reviewing Linux kernel versions for exposure, verifying fixes for the memcg vulnerability, and monitoring Linux kernel updates for potential related vulnerabilities.

Why it matters

CVE-2026-93240 is a vulnerability in the Linux kernel's memcg subsystem involving the deprecation of the v1 soft limit knob. Linux kernel maintainers and users should assess exposure and verify applied fixes.

• Verify Linux kernel versions for CVE-2026-93240 exposure
• Assess and apply fixes for the memcg vulnerability
• Monitor Linux kernel updates for potential related vulnerabilities

Technical summary

The Linux kernel's memcg subsystem had a vulnerability involving the v1 soft limit knob, which has been deprecated since Linux kernel version 6.12. This knob has been made inert to prevent any potential issues. The change keeps the memory.soft_limit_in_bytes interface but makes writes to it inert and always reports the maximum value on read. This change also fixes the syzbot report linked. Soft limit reclaim is the only caller that runs shrink_lruvec() from kswapd against a specific memcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn set_mm_walk(), which warns when called from kswapd. Linux kernel maintainers and users should assess exposure and verify the applied fix.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the applied fix.

Recommended defensive actions

• Review Linux kernel versions and assess exposure to CVE-2026-93240
• Verify applied fixes for the memcg vulnerability
• Monitor Linux kernel updates for potential related vulnerabilities
• Confirm whether affected Linux kernel deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed Linux kernel assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution in the Linux kernel. The vulnerability involves making the v1 soft limit knob inert. The NVD entry is currently Received.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.