Linux kernel MGLRU: stale batch updates after memcg reparenting cause premature OOM kills

Impact

The MGLRU page-table walker accumulates per-generation page deltas without the lruvec lock and folds them in later. If a memory cgroup is reparented (offlined) in between, the deltas land on the dying child's lruvec, so the surviving cgroup's nr_pages is undercounted. MGLRU stops reclaiming once its counter hits zero even though reclaimable pages remain, so the kernel OOM-kills processes on a node that still has memory. On a GPU node this is felt as training or inference pods being OOM-killed under normal churn: every pod teardown offlines a memcg, so the racing condition recurs continuously on a busy multi-tenant node, and the kill lands on whichever workload was resident, not the one that caused it. There is no cross-tenant data exposure here - the cost is availability and wasted GPU-hours on restarted jobs.

Who can reach it

No attacker required and no authentication involved - this is a race between normal kernel paths. Any workload that creates and destroys cgroups (i.e. any container churn on the node) can trigger it on kernels with MGLRU (lru_gen) enabled. Not reachable remotely and not usable to cross a tenant boundary.

What to do

Take the fix from the stable kernel commits and reboot each node; the change is in core mm and cannot be hot-patched or applied by restarting a daemon. Nodes must be drained before reboot, which on a GPU fleet means evicting long-running training jobs. As an interim mitigation on kernels where MGLRU is optional, disabling multi-gen LRU (echo 0 > /sys/kernel/mm/lru_gen/enabled) removes the affected code path, at the cost of reverting to the legacy reclaim behaviour. The record lists stable commits but no fixed release numbers - check your distribution's advisory for the version that carries them.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical