CVE-2026-98414: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98414 is a Linux kernel vulnerability in the memory control group (memcg) subsystem where obj_cgroup_charge_pages() can incorrectly charge the root memcg, leading to a kernel warning and asymmetric charge/uncharge accounting. The flaw was introduced at commit 20d6c17252282c3af261d1cde8e34def1b2458c8 and affects Linux kernel version 6.15. It was published on October 14, 2026, with a CVSS category estimate of Medium (Feedly, Linux CVE Announce).

The root cause is a logic flaw in obj_cgroup_charge_pages() within the Linux kernel's memory controller (memcg). When a cgroup is removed (rmdir), memcg_reparent_objcgs() redirects the dying child's object cgroup (objcg->memcg) to the parent memcg. However, obj_cgroup_is_root() is never updated to reflect this reparenting, so an objcg belonging to a dying child of root passes all root-cgroup filters but resolves to the root memcg when charging. This causes try_charge_memcg() — which does not short-circuit for the root memcg — to be called with the root memcg, triggering a WARN_ON in refill_stock() and creating an asymmetric charge/uncharge imbalance. The issue is reachable via zswap: allocate anonymous memory in a cgroup, move the task out, remove the cgroup, then trigger reclaim via memory.reclaim on the root cgroup (Feedly, Linux CVE Announce).

Exploitation of this vulnerability results in a kernel warning (WARN_ON) and an asymmetric memory charge/uncharge condition in the root memcg, which can lead to memory accounting corruption. This may cause incorrect memory limit enforcement, potential denial-of-service conditions due to memory management instability, and unpredictable behavior in containerized or cgroup-isolated workloads. The impact is limited to availability and integrity of memory accounting; there is no evidence of privilege escalation or data exfiltration potential (Feedly).

There are no known public proof-of-concept exploits, exploit kits, or evidence of in-the-wild exploitation for CVE-2026-98414 as of the time of publication (Feedly). The vulnerability requires local access to create and manage cgroups, limiting the attack surface to privileged or container-capable local users. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score data is currently available. The Feedly assessment notes limited information and ongoing monitoring for exploitation evidence.

1. Setup: On a Linux 6.15 system with zswap enabled, create a child cgroup under the root cgroup and allocate anonymous memory within it.
2. Task migration: Move the task out of the child cgroup to another cgroup or the root cgroup.
3. Cgroup removal: Remove (rmdir) the now-empty child cgroup, triggering memcg_reparent_objcgs() to redirect the objcg's memcg pointer to the parent (root) memcg.
4. Trigger reclaim: Write to the root cgroup's memory.reclaim interface to initiate memory reclaim, causing zswap to process folios that still hold a reference to the reparented objcg.
5. Trigger the bug: The reclaim path calls obj_cgroup_charge_zswap() → obj_cgroup_charge() → obj_cgroup_charge_pages(), which resolves the objcg to the root memcg and calls try_charge_memcg() without short-circuiting, triggering the WARN_ON in refill_stock() and causing asymmetric accounting (Feedly, Linux CVE Announce).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log of the form WARNING: mm/memcontrol.c:2198 at refill_stock+0x644/0x940 with a stack trace involving try_charge_memcg, obj_cgroup_charge_zswap, zswap_store, and shrink_folio_list.
• Process/Behavior: Unusual memory accounting discrepancies in root cgroup memory statistics; unexpected zswap activity correlated with cgroup removal events.
• System Events: Repeated cgroup creation, task migration, and rmdir operations on child cgroups followed by memory.reclaim writes to the root cgroup (Feedly).

Fixed commits have been identified for the affected kernel versions: d5cdff14c385bf42d03c0dd4c3e88ddf4c28b8a9 (for one stable branch), ecc03877b1b05cb1e3a72175ccb868383eccc518, and 6e673d0879ef78c395cfe0d3ba316690a60055d8. Unaffected versions include Linux kernel 6.18.54 and later (within the 6.18.x series), 7.2.8 and later (within the 7.2.x series), and 7.3-rc4 and later. Users should upgrade to a patched kernel version as the primary remediation; as a temporary workaround, disabling zswap (zswap.enabled=0 kernel parameter) can prevent the vulnerable code path from being triggered (Feedly, Linux CVE Announce).