Linux mm: shrinker_info teardown races with expansion, giving a double free of memcg shrinker maps

Impact

alloc_shrinker_info() dropped shrinker_mutex before freeing a partially initialized shrinker_info array for a memcg that is still visible to iteration, so a concurrent shrinker_alloc() can copy from - and later kvfree_rcu() - a pointer the first path has already freed. The same window exists on the mem_cgroup_css_online() unwind path when an objcg allocation fails after shrinker_info was published. The result is a double free or use-after-free of kernel heap, i.e. a node crash or a corruption primitive. Container hosts are the population that hits this: memcgs are created and destroyed on every pod start and stop, and the allocation failure that opens the window is most likely exactly when the node is under memory pressure. A GPU node lost this way takes its running training jobs with it and is expensive to drain and reschedule.

Who can reach it

Local, and not a clean attacker-controlled trigger. It needs a cgroup coming online whose shrinker_info allocation fails to race a shrinker registration. Anything that can create cgroups at volume (a pod-spawning agent, nested containers) while driving the node toward memory exhaustion raises the odds; the record describes no deterministic trigger and no remote path.

What to do

Take the stable kernel update and reboot each node; the fix is a locking change in mm, so there is nothing to toggle at runtime. Four stable commits are listed and no fixed release version. Reasonable to bundle into the next scheduled kernel maintenance rather than an out-of-band window, given the race needs an allocation failure to open it.

References

Related entries

• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel sockmap: cork use-after-free when two threads send on the same socketCVE-2026-68284 · Linux kernel BPF sockmap (tcp_bpf_sendmsg cork handling)High