UBUNTU-CVE-2026-93240: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep memory.softlimitinbytes, but ignore writes to it and always report the maximum value on read similar to what memory.kmem.limitinbytes already does. Writes are still parsed, so malformed input keeps returning -EINVAL. The knob now also behaves the same everywhere: it used to return -EOPNOTSUPP on PREEMPTRT, where soft limit reclaim has always been disabled. This also fixes the syzbot report linked below. Soft limit reclaim is the only caller that runs shrinklruvec() from kswapd against a specific memcg, so it is the only way to reach lrugenshrinklruvec() and in turn setmmwalk(), which warns when called from kswapd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Treat the v1 memory.soft_limit_in_bytes knob as inert: continue parsing writes so malformed input returns -EINVAL, but ignore valid writes and always report the maximum value when read.
Linux kernel cgroup v1 memory controller memory.soft_limit_in_bytes = maximum value on read; writes ignored