CVE-2026-93240
Received Received - Intake

Memory Soft Limit Knob Deprecation in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep memory.soft_limit_in_bytes, but ignore writes to it and always report the maximum value on read similar to what memory.kmem.limit_in_bytes already does. Writes are still parsed, so malformed input keeps returning -EINVAL. The knob now also behaves the same everywhere: it used to return -EOPNOTSUPP on PREEMPT_RT, where soft limit reclaim has always been disabled. This also fixes the syzbot report linked below. Soft limit reclaim is the only caller that runs shrink_lruvec() from kswapd against a specific memcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn set_mm_walk(), which warns when called from kswapd.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93240
EUVD
EUVD-2026-86246

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Linux kernel's memory controller (memcg) v1 soft limit feature. The v1 soft limit has been deprecated since kernel version 6.12 and is no longer actively used. The fix makes the soft limit knob inert by ignoring writes to memory.soft_limit_in_bytes and always reporting the maximum value on read, similar to another existing limit. This change decouples the interface from the implementation while maintaining backward compatibility for parsing writes.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory cgroup (memcg) v1 soft limit interface. Detection involves checking kernel logs for warnings related to soft limit reclaim or lru_gen_shrink_lruvec. Commands like dmesg | grep -i 'soft limit' or journalctl -k | grep -i 'soft limit' may help identify issues.

Impact Analysis

This vulnerability primarily affects systems running the Linux kernel where the deprecated v1 soft limit feature was still being used. Users relying on memory.soft_limit_in_bytes for soft memory limits may experience unexpected behavior as writes are now ignored and reads always return the maximum value. Systems using PREEMPT_RT may see improved consistency since the knob now behaves uniformly.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a deprecated memory management feature in the Linux kernel that has no reported dependencies or active use. The change only affects internal kernel behavior and does not impact data protection or privacy controls.

Mitigation Strategies

Since the v1 soft limit is deprecated and now inert, no immediate action is required unless you rely on this deprecated feature. Update to a kernel version that includes this fix (post-v6.12) to ensure the interface is properly disabled. Monitor kernel updates for further changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart