CVE-2026-53153

A flaw was found in the Linux kernel's memory cgroup (memcg) list_lru component. A race condition occurs during the reparenting of list_lru entries when an xarray entry is cleared before its associated lists are fully reparented. This allows concurrent operations to modify list pointers under different locks, leading to memory corruption. This corruption can result in system instability or a denial of service (DoS).

A race condition flaw in the Linux kernel's memory cgroup (memcg) list_lru subsystem has been rated as having IMPORTANT severity for affected Red Hat products. When a memory cgroup is destroyed, memcg_reparent_list_lrus() clears the dying cgroup's xarray entry before its per-node lists have been fully reparented to the parent cgroup. In this window, a concurrent list_lru_del() sees the cleared entry, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and unlinks an item that is still physically linked on the dying cgroup's list. If another in-flight thread (another list_lru_del() or a list_lru_walk_one() isolate callback) holds the dying cgroup's per-node lock at the same moment, both threads modify the ->next/->prev pointers of the same physical list under different locks, corrupting adjacent list entries. The verified consequence is kernel memory corruption, which can lead to system instability or a denial of service, and in the worst case may compromise confidentiality or integrity. Exploitation requires local access: a local user with low privileges who can create and remove memory cgroups while generating list_lru activity could trigger this flaw, but it depends on winning a narrow timing window (high attack complexity). Red Hat's severity of IMPORTANT with CVSS 3.1 score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the upstream CVE.org severity. The vulnerable per-cgroup list_lru locking code is present only in recent Red Hat kernel streams: Red Hat Enterprise Linux 6, 7, 8, 9, and 10.0 are not affected because the vulnerable code is not present, while Red Hat Enterprise Linux 10.2, 10.3, and Red Hat In-Vehicle OS 2 are affected, and a fix is being pursued for those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.