{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-53162", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-53162" ], "published": "2026-06-25T08:41:40Z", "summary": "memcg: use round-robin victim selection in refill_stock", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: use round-robin victim selection in refill_stock\n\nHarry Yoo reported that get_random_u32_below() is not safe to call in the\nnmi context and memcg charge draining can happen in nmi context.\n\nMore specifically get_random_u32_below() is neither reentrant- nor\nNMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave() on the\nbatched_entropy_u32 state. An NMI that lands on a CPU mid-update of the\nChaCha batch state and recurses into the random subsystem would corrupt\nthat state. The memcg_stock local_trylock prevents re-entry on the percpu\nstock itself, but cannot protect an unrelated subsystem's per-cpu lock.\n\nReplace the random pick with a per-cpu round-robin counter stored in\nmemcg_stock_pcp and serialized by the same local_trylock that already\nguards cached[] and nr_pages[]. No atomics, no random calls, no extra\nlocks needed.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.36" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.36" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.36" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53162" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/89bd8215e25aa6999cc51696da418e0d422bc5e0" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/00731bd7e18f182a32ca54d6b176eaa470b51ed7" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c0cafe24d3f6534294c4b2bc2d47734ff7cbd313" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The vulnerable `refill_stock()` path is reached through local kernel activity such as memcg-accounted allocation/free paths and NMI-capable perf/BPF-style execution, not by unauthenticated network packets alone.\nAC:L - An attacker can repeatedly drive memcg stock eviction and high-rate NMI/RNG activity; the race is timing-sensitive but both sides are influenceable from local execution.\nPR:L - Reachability requires a local user context able to create or use memcg-accounted workloads and NMI-capable facilities such as perf/BPF or delegated equivalents, so low privileges are sufficient in a plausible deployment.\nUI:N - No separate victim action is required once the attacker can run the local workload and trigger the accounting/NMI activity.\nS:U - The corrupted state is inside the same kernel security authority; this is not a VM, IOMMU, or sandbox boundary escape by itself.\nC:H - The bug corrupts per-CPU random subsystem batch state used for security-sensitive randomness, so confidentiality impact is high under the required higher-severity assumption.\nI:H - Corruption of kernel RNG state can undermine integrity of random-dependent kernel protections and identifiers, and the vulnerable interleaving includes state writes outside the intended entropy slot.\nA:H - Kernel per-CPU state corruption in NMI context can lead to unpredictable kernel malfunction or hard failure, so availability impact is high." } } }