CVE-2026-93240: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93240 is a Linux kernel vulnerability in the memory control group (memcg) subsystem related to improper handling of the cgroup v1 soft limit reclaim mechanism. The issue stems from the deprecated memory.soft_limit_in_bytes knob (deprecated since kernel v6.12) remaining functionally active, allowing soft limit reclaim to trigger shrink_lruvec() from kswapd against a specific memcg — the only path that can reach lru_gen_shrink_lruvec() and set_mm_walk(), which generates a kernel warning when called from kswapd. Affected Linux kernel versions include those from v6.3 up to (but not including) v6.12.110, v6.18.51, and v7.2.5. It was published on September 24, 2026, with a CVSS category estimate of Medium and an EPSS score of approximately 0.218% (Feedly, EUVD).

The root cause is an improper state management issue (related to CWE-664: Improper Control of a Resource Through its Lifetime) in the Linux kernel's memcg subsystem. The deprecated memory.soft_limit_in_bytes interface in cgroup v1 continued to influence kernel behavior: writes to this knob could configure soft limit reclaim, which is the sole code path that invokes shrink_lruvec() from the kswapd kernel thread targeting a specific memcg. This in turn reaches lru_gen_shrink_lruvec() and set_mm_walk(), a function that asserts it must not be called from kswapd, triggering a kernel warning (WARN). The fix decouples the interface from the implementation — writes to memory.soft_limit_in_bytes are parsed but ignored, and reads always return the maximum value, effectively making the knob inert (Feedly, Kernel Patch).

Successful triggering of this vulnerability causes a kernel warning (WARN) when set_mm_walk() is called from kswapd, which can result in system instability or denial of service on affected Linux systems using cgroup v1 memory soft limits. The impact is primarily an availability concern — the kernel warning may lead to unexpected behavior in memory reclaim paths, potentially degrading system performance or causing crashes in certain configurations. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

There are no known public proof-of-concept exploits or reports of in-the-wild exploitation for CVE-2026-93240. The vulnerability was originally identified via a syzbot (automated kernel fuzzer) report. The EPSS score is approximately 0.218%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

The Linux kernel maintainers have released fixes in stable versions 6.12.110, 6.18.51, 7.2.5, and 7.3-rc2. The fix makes the memory.soft_limit_in_bytes cgroup v1 knob inert — writes are parsed but ignored, and reads return the maximum value — thereby disabling soft limit reclaim and eliminating the vulnerable code path. Users running affected kernel versions (v6.3 through the fixed releases) should upgrade to a patched version. As a temporary workaround, avoiding the use of memory.soft_limit_in_bytes in cgroup v1 configurations will prevent triggering the vulnerable reclaim path (Feedly, Kernel Patch).