Incorrect calculation in Linux kernel - CVE-2026-98414

Vulnerability details

The vulnerability allows a local user to trigger kernel warnings and cause a persistent memory-accounting leak.

The vulnerability exists due to asymmetric charging and uncharging of the root memory cgroup in obj_cgroup_charge_pages() when reclaiming folios associated with reparented object cgroups. A local user can allocate anonymous memory in a child cgroup, move the task out, remove the child cgroup, and trigger memory reclaim in the root cgroup to trigger kernel warnings and cause a persistent memory-accounting leak.

The described reproduction uses enabled zswap and swap and requires permission to manage cgroups and write to the root cgroup's memory.reclaim interface. The affected page counter is not exposed through memory.current on the root cgroup.

Affected software

How to mitigate CVE-2026-98414

External References

• https://git.kernel.org/stable/c/6e673d0879ef78c395cfe0d3ba316690a60055d8
• https://git.kernel.org/stable/c/d5cdff14c385bf42d03c0dd4c3e88ddf4c28b8a9
• https://git.kernel.org/stable/c/ecc03877b1b05cb1e3a72175ccb868383eccc518

Related Security Bulletins

• Incorrect calculation in Linux kernel mm
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more