CVE-2026-98414: memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
In the Linux kernel, the following vulnerability has been resolved:
memcg: avoid charging the root memcg from objcgroupchargepages()
objcgroupchargepages() resolves the objcg to its memcg and calls trychargememcg(), which does not short circuit the root memcg. That memcg can be the root memcg: objcgroupisroot() reflects the memcg the objcg was created for and is never updated, while memcgreparentobjcgs() does redirect objcg->memcg to the parent on rmdir. An objcg of a dying child of root therefore passes every objcgroupisroot() filter but resolves to the root memcg.
Folios keep the objcg they were charged with, so this is easy to reach through zswap: allocate anon memory in a cgroup, move the task out, remove the cgroup, then write to the root cgroup's memory.reclaim. The reclaimed folios are charged through the reparented objcg and end up in refillstock() with the root memcg:
WARNING: mm/memcontrol.c:2198 at refillstock+0x644/0x940 refillstock+0x644/0x940 trychargememcg+0x12d6/0x1570 objcgroupcharge+0x35/0xf0 objcgroupcharge+0x1de/0x210 objcgroupchargezswap+0x83/0x270 zswapstore+0x1620/0x2000 swapwriteout+0x94c/0x14c0 shrinkfoliolist+0x3388/0x52b0 [...] trytofreememcgrouppages+0x30d/0x830 userproactivereclaim+0x504/0x840 memoryreclaim+0x1f/0x30
Beyond the warning, the charge is asymmetric: objcgroupunchargepages() skips refillstock() for the root memcg, so the root's page counter grows and is never uncharged. It is not user visible, since memory.current is not exposed on the root, but it is a leak.
Use trycharge(), which returns early for the root memcg, restoring the symmetry with objcgroupunchargepages().
The above sequence was scripted into a standalone reproducer (zswap on, swap on a virtio disk, 512MB of anon memory faulted in inside a child of the root cgroup, the task then migrated to the root cgroup, the child removed, followed by "echo 600M swappiness=max > memory.reclaim" on the root) and run in a CONFIGDEBUGVM=y VM. It reproduces the splat on the first zswap store of a reparented folio, with the same call chain as the report. With this patch applied the splat is gone while the zswap store count over the run is unchanged, so the same path is still exercised. cgroup selftests testzswap, testkmem and testmemcontrol show no new failures.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the warning?
A child memory cgroup of the root cgroup must have an object cgroup that is later reparented when that child cgroup is removed. The described path allocates anonymous memory in the child cgroup, moves the task out, removes the child cgroup, and then writes to the root cgroup's memory.reclaim; zswap can cause the reclaimed folios to be charged through the reparented object cgroup.
Is this limited to an object cgroup that was originally created for the root cgroup?
No. The affected case is an object cgroup created for a child of the root cgroup that becomes a dying child and is reparented to root. Its root-status check still reflects the original child cgroup, while its memcg pointer resolves to the root cgroup.
How can an administrator recognize the issue?
The described symptom is a kernel WARNING in mm/memcontrol.c at refill_stock(), with a stack involving try_charge_memcg(), obj_cgroup_charge_zswap(), zswap_store(), swap_writeout(), and shrink_folio_list.