In the Linux kernel, the following vulnerability has been resolved:
memcg: keep folio's objcg same as its node
memcg_reparent_objcgs() has an inherent assumption that a folio's objcg is
the objcg of the folio's node. Folio migration across nodes breaks that
assumption: the new folio simply inherits the old folio's objcg while
living on a different node.
Once the assumption is broken, the reparenting of the folio's objcg and
the reparenting of the folio's LRU list are no longer atomic.
memcg_reparent_objcgs() handles one node per iteration and drops all the
locks in between, so the objcg gets reparented in the iteration for the
objcg's node while the LRU list gets spliced in the iteration for the
folio's node. Any LRU operation on that folio in between resolves its
lruvec through the objcg, and thus takes the lru_lock of the wrong memcg,
not the lru_lock of the list the folio is actually on.
Fix this by selecting the objcg by folio_nid() at charge time, and by
re-deriving it for the destination node in mem_cgroup_migrate() and
mem_cgroup_replace_folio().
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The bug is reached only via local syscalls: creating/rmdiring a memory cgroup, NUMA placement or page migration (set_mempolicy, mbind with MPOL_MF_MOVE, move_pages), and LRU activity (mmap, madvise, mlock, munmap). It is not reachable from unauthenticated network packets.
AC:L - The attacker drives both sides of the race: they create the folio objcg/node mismatch (charge on one node, folio on another, or migrate_pages) and then rmdir the cgroup while another thread hammers LRU ops in the unlocked window between per-node reparent iterations, retrying at will.
PR:L - Offlining the memcg needs write access to a cgroup subtree, which Linux delegates to unprivileged users and cgroup namespaces (systemd user slices, containers). NUMA syscalls on the attacker’s own pages need no capability. This is not init-namespace root.
UI:N - The attacker performs every step themselves: creating and removing the memory cgroup, placing or migrating folios across NUMA nodes, and exercising LRU paths. No separate victim action is required.
S:U - Corruption is of in-kernel LRU list_heads and memcg per-node lruvecs in the same kernel security authority. This is local kernel memory corruption, not a VM escape or IOMMU bypass.
C:H - folio_lruvec_lock() takes the wrong lru_lock, so LRU ops can list_del/list_add a folio onto a dying memcg’s LRU; after css_free the lruvec is kfree’d while the folio remains linked, a kernel UAF that yields an arbitrary-read primitive.
I:H - Concurrent list_add/list_del of folio->lru under different lruvec locks corrupts kernel list_head next/prev pointers and can write through attacker-influenced links, a classic list-UAF arbitrary-write / control-flow hijack primitive.
A:H - List corruption and use-after-free of the offlined memcg’s lruvec cause kernel oopses, panics, or hangs during reclaim, isolation, or folio free even when the UAF is not fully turned into code execution.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is reached only via local syscalls: creating/rmdiring a memory cgroup, NUMA placement or page migration (set_mempolicy, mbind with MPOL_MF_MOVE, move_pages), and LRU activity (mmap, madvise, mlock, munmap). It is not reachable from unauthenticated network packets.
AC:L - The attacker drives both sides of the race: they create the folio objcg/node mismatch (charge on one node, folio on another, or migrate_pages) and then rmdir the cgroup while another thread hammers LRU ops in the unlocked window between per-node reparent iterations, retrying at will.
PR:L - Offlining the memcg needs write access to a cgroup subtree, which Linux delegates to unprivileged users and cgroup namespaces (systemd user slices, containers). NUMA syscalls on the attacker’s own pages need no capability. This is not init-namespace root.
UI:N - The attacker performs every step themselves: creating and removing the memory cgroup, placing or migrating folios across NUMA nodes, and exercising LRU paths. No separate victim action is required.
S:U - Corruption is of in-kernel LRU list_heads and memcg per-node lruvecs in the same kernel security authority. This is local kernel memory corruption, not a VM escape or IOMMU bypass.
C:H - folio_lruvec_lock() takes the wrong lru_lock, so LRU ops can list_del/list_add a folio onto a dying memcg’s LRU; after css_free the lruvec is kfree’d while the folio remains linked, a kernel UAF that yields an arbitrary-read primitive.
I:H - Concurrent list_add/list_del of folio->lru under different lruvec locks corrupts kernel list_head next/prev pointers and can write through attacker-influenced links, a classic list-UAF arbitrary-write / control-flow hijack primitive.
A:H - List corruption and use-after-free of the offlined memcg’s lruvec cause kernel oopses, panics, or hangs during reclaim, isolation, or folio free even when the UAF is not fully turned into code execution.
CVSS 3.1