UBUNTU-CVE-2026-98414: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages() objcgroupchargepages() resolves the objcg to its memcg and calls trychargememcg(), which does not short circuit the root memcg. That memcg can be the root memcg: objcgroupisroot() reflects the memcg the objcg was created for and is never updated, while memcgreparentobjcgs() does redirect objcg->memcg to the parent on rmdir. An objcg of a dying child of root therefore passes every objcgroupisroot() filter but resolves to the root memcg. Folios keep the objcg they were charged with, so this is easy to reach through zswap: allocate anon memory in a cgroup, move the task out, remove the cgroup, then write to the root cgroup's memory.reclaim. The reclaimed folios are charged through the reparented objcg and end up in refillstock() with the root memcg: WARNING: mm/memcontrol.c:2198 at refillstock+0x644/0x940 refillstock+0x644/0x940 trychargememcg+0x12d6/0x1570 objcgroupcharge+0x35/0xf0 objcgroupcharge+0x1de/0x210 objcgroupchargezswap+0x83/0x270 zswapstore+0x1620/0x2000 swapwriteout+0x94c/0x14c0 shrinkfoliolist+0x3388/0x52b0 [...] trytofreememcgrouppages+0x30d/0x830 userproactivereclaim+0x504/0x840 memoryreclaim+0x1f/0x30 Beyond the warning, the charge is asymmetric: objcgroupunchargepages() skips refillstock() for the root memcg, so the root's page counter grows and is never uncharged. It is not user visible, since memory.current is not exposed on the root, but it is a leak. Use trycharge(), which returns early for the root memcg, restoring the symmetry with objcgroupunchargepages(). The above sequence was scripted into a standalone reproducer (zswap on, swap on a virtio disk, 512MB of anon memory faulted in inside a child of the root cgroup, the task then migrated to the root cgroup, the child removed, followed by "echo 600M swappiness=max > memory.reclaim" on the root) and run in a CONFIGDEBUGVM=y VM. It reproduces the splat on the first zswap store of a reparented folio, with the same call chain as the report. With this patch applied the splat is gone while the zswap store count over the run is unchanged, so the same path is still exercised. cgroup selftests testzswap, testkmem and testmemcontrol show no new failures.