CVE-2026-93240: memcg: make the v1 soft limit knob inert
In the Linux kernel, the following vulnerability has been resolved:
memcg: make the v1 soft limit knob inert
The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep memory.softlimitinbytes, but ignore writes to it and always report the maximum value on read similar to what memory.kmem.limitinbytes already does.
Writes are still parsed, so malformed input keeps returning -EINVAL. The knob now also behaves the same everywhere: it used to return -EOPNOTSUPP on PREEMPTRT, where soft limit reclaim has always been disabled.
This also fixes the syzbot report linked below. Soft limit reclaim is the only caller that runs shrinklruvec() from kswapd against a specific memcg, so it is the only way to reach lrugenshrinklruvec() and in turn setmmwalk(), which warns when called from kswapd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to the affected code path?
Systems using cgroup v1 memory control groups with soft limit reclaim enabled can reach the affected path. The issue does not apply to PREEMPT_RT through this interface, because soft limit reclaim has always been disabled there.
What must occur to trigger the warning path?
Soft limit reclaim must invoke shrink_lruvec() from kswapd for a specific memory cgroup. This is the only stated route to lru_gen_shrink_lruvec() and set_mm_walk(), which warns when invoked from kswapd.
What happens to existing memory.soft_limit_in_bytes users after the fix?
The file remains present, but writes no longer affect soft-limit behavior and reads always return the maximum value. Input is still parsed, so malformed writes continue to fail with -EINVAL.