CVE-2026-93216
Received Received - Intake

Linux Kernel TOCTOU in Page Owner Memory Tracking

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places: 1: page_memcg_check(page) 2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS) If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM_BUG_ON assertions can trigger on CONFIG_DEBUG_VM=y builds, crashing the kernel. Fix both TOCTOU issues by using the memcg_data snapshot throughout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93216
EUVD
EUVD-2026-85945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a race condition in the page ownership tracking system (mm/page_owner) can lead to kernel crashes. The issue occurs when the function print_page_owner_memcg() reads memory cgroup data inconsistently due to concurrent page reallocation, triggering VM_BUG_ON assertions on CONFIG_DEBUG_VM builds.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and requires kernel debugging features enabled. Detection involves checking kernel logs for VM_BUG_ON assertions related to page ownership or memory cgroup handling. Use dmesg | grep -i 'BUG\|page_owner\|memcg' to search for relevant errors. If CONFIG_DEBUG_VM is enabled, crashes may appear during memory operations.

Impact Analysis

If exploited, this vulnerability could cause system instability or crashes, particularly on systems with CONFIG_DEBUG_VM enabled. It may lead to denial-of-service conditions but does not directly expose data or allow privilege escalation.

Compliance Impact

This vulnerability primarily impacts system availability rather than data confidentiality or integrity. Compliance impact would be indirect, potentially affecting uptime requirements for GDPR or HIPAA if the system crashes cause service disruptions.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to resolve the TOCTOU issue in mm/page_owner. If immediate patching is not possible, avoid enabling CONFIG_DEBUG_VM or disable page_owner functionality via kernel parameters (page_owner=off). Monitor systems for crashes or memory corruption errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart