CVE-2026-98414 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for managing memory cgroups, operators managing Linux kernel-based systems, security teams monitoring for potential denial-of-service (DoS) attacks, and vulnerability management teams responsible for applying patches and mitigations. These individuals should review and apply patches, monitor memory usage, and restrict access to sensitive memory-related operations to prevent exploitation of this and '

Why it matters

A vulnerability in the Linux kernel's memcg subsystem can be exploited to charge the root memcg from obj_cgroup_charge_pages(), potentially leading to unintended memory usage.

• Verify memory usage and cgroup configurations to prevent unintended memory usage
• Apply patches to prevent exploitation of this vulnerability
• Monitor system for potential denial-of-service (DoS) attacks

Technical summary

The vulnerability is caused by the obj_cgroup_charge_pages() function not short-circuiting the root memcg. This can lead to folios being charged through the reparented objcg and ending up in refill_stock() with the root memcg. The issue arises when an objcg of a dying child of the root passes every obj_cgroup_is_root() filter but resolves to the root memcg. This can be triggered through zswap by allocating anon memory in a cgroup, moving the task out, removing the cgroup, and then writing to the root cgroup's memory.reclaim.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Monitor memory usage and cgroup configurations
• Restrict access to sensitive memory-related operations
• Verify memory usage and cgroup configurations to prevent unintended memory usage
• Apply patches to prevent exploitation of this vulnerability
• Monitor system for potential denial-of-service (DoS) attacks
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the obj_cgroup_charge_pages() function not short-circuiting the root memcg. This can lead to folios being charged through the reparented objcg and ending up in refill_stock() with the root memcg.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.