SB20260925141 - Resource exhaustion in Linux kernel mm

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: CVE-2026-93241)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory charges for OOM victims in the memory cgroup charge handling logic when an OOM victim continues charging memory after the OOM reaper has set MMF_OOM_SKIP. A local user can cause exiting threads to serialize on oom_lock to cause a denial of service.

Exploitation requires an OOM-killed multithreaded process and OOM reaper failure caused by mmap_lock contention.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7
• https://git.kernel.org/stable/c/801bcbdbfd595cc7f0de95f2802b5596c8971315
• https://git.kernel.org/stable/c/d44c3c5986c7a4a5f913a813e18cda08a838f91b