CVE-2026-93241 Linux CVE debrief

Who should care

Linux kernel administrators, especially those with high memory usage and oom_reaper enabled, should assess exposure and prioritize verification of affected systems. They should review system logs for 'Out of memory and no killable processes...' messages, verify oom_reaper configuration and performance, assess system memory usage and adjust memory.max limits as needed, and monitor for similar issues with high memory usage and oom_reaper enabled.

Why it matters

Linux kernel administrators should assess exposure and prioritize verification of affected systems, especially those with high memory usage and oom_reaper enabled, to prevent similar issues.

• Verification of oom_reaper configuration and performance is necessary to prevent similar issues
• Administrators should assess system memory usage and adjust memory.max limits as needed
• Monitoring for similar issues with high memory usage and oom_reaper enabled is crucial

Technical summary

The Linux kernel vulnerability was caused by serialization behind the oom_lock, which could lead to a killed job being stuck in the exit path for several hours. This was observed in a job with ~55 GiB memory.max and zswap enabled, which had almost 0 anon in memory and ~111 GiB in zswap compressed to ~51 GiB zswap pool. The oom reaper was not able to reap/unmap the process, leading to a glacial oom_lock-serialized synchronous drain. The issue was resolved by bypassing the reclaim and oom killer for dying tasks once oom_reaper is done.

Defensive priority

Linux kernel administrators should assess exposure and prioritize verification of affected systems, especially those with high memory usage and oom_reaper enabled.

Recommended defensive actions

• Review system logs for 'Out of memory and no killable processes...' messages
• Verify oom_reaper configuration and performance
• Assess system memory usage and adjust memory.max limits as needed
• Monitor for similar issues with high memory usage and oom_reaper enabled
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The issue was observed in a job with ~55 GiB memory.max and zswap enabled, which had almost 0 anon in memory and ~111 GiB in zswap compressed to ~51 GiB zswap pool. The oom reaper was not able to reap/unmap the process, leading to a glacial oom_lock-serialized synchronous drain. The job was a single process job and had ~55 GiB memory.max and zswap enabled. It had almost 0 anon in memory and ~111 GiB in zswap compressed to ~51 GiB zswap pool.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.