CVE-2026-98414

A flaw was found in the Linux kernel. An issue in the memory control group (memcg) subsystem occurs when memory allocated within a child control group is transferred to the root group upon group deletion. Subsequent memory reclamation improperly charges pages to the root group without ever uncharging them. A local user could exploit this flaw to cause kernel warnings and an internal memory accounting leak, potentially leading to a Denial of Service (DoS).

A low severity flaw was found in the Linux kernel's memory control group (memcg) subsystem. When a direct child of the root control group is removed, its object charges are reparented to the root memcg. Because obj_cgroup_charge_pages() does not short-circuit the root memcg, subsequent memory reclamation of the reparented pages (demonstrated through zswap) charges them to the root memcg and triggers a kernel WARNING in refill_stock(). As the corresponding uncharge path skips the root memcg, the root's page counter grows without ever being uncharged, resulting in an internal memory accounting leak that is not directly user-visible, since memory.current is not exposed for the root cgroup. Exploitation requires local access with administrative (root) privileges, because triggering the issue involves creating and removing a direct child of the root cgroup and triggering proactive memory reclaim on the root cgroup; the practical consequence is kernel warning output and an internal accounting leak rather than memory exhaustion or a system crash, which is reflected in the low Red Hat severity rating. Among Red Hat products, the vulnerable code is present only in the Red Hat Enterprise Linux 10 kernel streams rhel-10.3.z and rhel-10.4 and in the Red Hat In-Vehicle OS 2 kernel streams; other Red Hat Enterprise Linux streams (including rhel-10.0.z and rhel-10.2.z) and the OpenShift Container Platform RHCOS kernels are not affected because the vulnerable code is not present in those versions. For the affected streams the fix is deferred to a future update given the low severity and the limited practical impact of the flaw; the residual risk is that a privileged local user performing this specific cgroup removal and reclaim sequence can generate kernel warnings and an internal, non-user-visible accounting leak on the root memcg.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.