Description
In the Linux kernel, the following vulnerability has been resolved:

memcg: make the v1 soft limit knob inert

The v1 soft limit has been deprecated since v6.12 and nobody has reported
depending on it. Start the removal by decoupling the interface from the
implementation: keep memory.soft_limit_in_bytes, but ignore writes to it
and always report the maximum value on read similar to what
memory.kmem.limit_in_bytes already does.

Writes are still parsed, so malformed input keeps returning -EINVAL. The
knob now also behaves the same everywhere: it used to return -EOPNOTSUPP
on PREEMPT_RT, where soft limit reclaim has always been disabled.

This also fixes the syzbot report linked below. Soft limit reclaim is the
only caller that runs shrink_lruvec() from kswapd against a specific
memcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn
set_mm_walk(), which warns when called from kswapd.
Published: 2026-09-24
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: Potential kernel instability due to mis‑handled memory limit configuration
Action: Assess Impact
AI Analysis

Impact

The Linux kernel contains an obsolete interface for setting a version‑1 soft memory limit. The vulnerability involves that interface still parsing and responding to write attempts, which can trigger warnings and affect memory reclamation logic. Because the knob is static and has no effect on newer kernels, the change removes the possibility of misconfigured memory limits causing erratic kernel behavior.

Affected Systems

All Linux kernel releases that expose the memory.soft_limit_in_bytes sysfs attribute, which was deprecated in version 6.12. This includes older kernels prior to 6.12. No specific version list is provided, but any kernel that still supports the deprecated soft limit knob is affected.

Risk and Exploitability

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation activity has been observed. The attack vector is likely local, requiring a user with permission to write to the sysfs file. Given the lack of remote access or privilege escalation capabilities, the risk of exploitation is low to moderate and the impact would primarily be system instability rather than critical compromise.

Generated by OpenCVE AI on September 25, 2026 at 10:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to version 6.12 or later so the soft limit knob is inert by design
  • Verify that no applications write to /sys/kernel/mm/memory.soft_limit_in_bytes on older kernels; if they do, modify or remove that behavior
  • If the kernel cannot be updated, monitor system logs for LRU shrink warnings that may indicate the knob is being accessed and consider temporarily mounting the sysfs entry read‑only to prevent accidental writes

Generated by OpenCVE AI on September 25, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DSA Debian DSA DSA-6528-1 linux security update
History

Wed, 21 Oct 2026 13:15:00 +0000


Fri, 25 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Thu, 24 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep memory.soft_limit_in_bytes, but ignore writes to it and always report the maximum value on read similar to what memory.kmem.limit_in_bytes already does. Writes are still parsed, so malformed input keeps returning -EINVAL. The knob now also behaves the same everywhere: it used to return -EOPNOTSUPP on PREEMPT_RT, where soft limit reclaim has always been disabled. This also fixes the syzbot report linked below. Soft limit reclaim is the only caller that runs shrink_lruvec() from kswapd against a specific memcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn set_mm_walk(), which warns when called from kswapd.
Title memcg: make the v1 soft limit knob inert
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-21T12:52:27.295Z

Reserved: 2026-09-17T16:02:15.095Z

Link: CVE-2026-93240

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T16:17:19.827

Modified: 2026-10-21T13:21:05.993

Link: CVE-2026-93240

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T10:45:18Z

Weaknesses
  • CWE-20

    Improper Input Validation