CVE-2026-93216 mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
A race condition in the Linux kernel page owner tracking can cause a kernel crash if debug VM assertions are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93216?
CVE-2026-93216 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places:
1: page_memcg_check(page)
2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)
If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM_BUG_ON assertions can trigger on CONFIG_DEBUG_VM=y builds, crashing the kernel.
Fix both TOCTOU issues by using the memcg_data snapshot throughout.
Which versions are affected by CVE-2026-93216?
How do I fix CVE-2026-93216?
Apply the vendor's patch.
Is CVE-2026-93216 being exploited?
There is no known exploitation of CVE-2026-93216 in the wild and no public exploit code.
Sources
Also known as AZL-103538, BELL-CVE-2026-93216, DEBIAN-CVE-2026-93216, GHSA-rrh5-8w69-2q6j, UBUNTU-CVE-2026-93216.