An inconsistency in the Linux kernel’s memory‑group LRU (mglru) page table walker caused an under‑count of resident pages when a memory cgroup is reparented while the walker is executing. The walker updates per‑generation deltas without holding the lruvec lock, and a later reset_batch_size() merges those deltas while holding the lock. If the reparenting path proceeds concurrently, the reset function may add the delta to a child’s lru_gen after the child has been marked dying, leading to a stale batch update. The result is that the accounting for active pages under a memcg underestimates the true number of pages, which triggers a premature OOM condition because the kernel believes the group has no pages to reclaim when it in fact still holds many.

All current Linux kernel releases that contain the vulnerable mglru implementation are affected, as the CVE does not list a specific version range. The issue lies in the generic kernel memory‑management code and is not limited to a particular architecture or distribution. Any system running a kernel version that has not applied the fix will be susceptible to the under‑counting bug.

The CVSS score and EPSS metric are not provided, but the nature of the flaw suggests a local denial of service–type risk. Based on the description, it is inferred that an attacker who can trigger a memcg reparenting while a page table walk is in progress—for example, by manipulating memory‑cgroup configuration in a privileged process—could cause the system to mis‑account memory and experience an out‑of‑memory kill that terminates unrelated processes. No public exploit has been reported and the vulnerability is not listed in the CISA KEV catalog; however, the underlying problem is a kernel‑level resource‑counting error, so mitigations rely on applying the kernel update that introduces a check for a dying CSS before flushing the pending batch.