VulnerabilityPublished 24 Sep 2026Updated 19 Oct 2026

CVE-2026-93241: Linux kernel · memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in d44c3c5986c7a4a5f913a813e18cda08a838f91b : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d44c3c5986c7a4a5f913a813e18cda08a838f91b, 801bcbdbfd595cc7f0de95f2802b5596c8971315, 6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to d44c3c5986c7a4a5f913a813e18cda08a838f91b, 801bcbdbfd595cc7f0de95f2802b5596c8971315 or 6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ a75ffa26122bba4a3fa9372aa13b32d7a5590425, < d44c3c5986c7a4a5f913a813e18cda08a838f91b	Fixed in d44c3c5986c7a4a5f913a813e18cda08a838f91b
LinuxLinux	Affected ≥ a75ffa26122bba4a3fa9372aa13b32d7a5590425, < 801bcbdbfd595cc7f0de95f2802b5596c8971315	Fixed in 801bcbdbfd595cc7f0de95f2802b5596c8971315
LinuxLinux	Affected ≥ a75ffa26122bba4a3fa9372aa13b32d7a5590425, < 6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7	Fixed in 6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7
LinuxLinux	Affected =6.16	Fixed in–

AI-suggested

A fix for this vulnerability has been committed in Linux kernel versions identified by the commits d44c3c5986c7a4a5f913a813e18cda08a838f91b, 801bcbdbfd595cc7f0de95f2802b5596c8971315, and 6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7. Users should update to a Linux kernel version including these commits to resolve the issue. No other mitigation or workaround is indicated in the advisory.

Description

CVE-2026-93241 is a vulnerability in the Linux kernel's memory controller (memcg) subsystem that causes processes killed by the out-of-memory (OOM) killer to become stuck in the exit path for extended periods. This occurs when the oom_reaper cannot reclaim memory asynchronously due to contention on the mmap_lock, leading to a serialized and slow synchronous drain of memory charges. The issue results in processes with many threads (e.g., 20,000) being blocked for hours during exit, causing system resource delays.

Impact

Processes killed by the OOM killer may remain stuck in the exit phase for hours, causing resource exhaustion and system instability. This can delay system recovery and affect overall system performance, especially on workloads with many threads and large memory usage. The issue does not appear to allow privilege escalation or arbitrary code execution but impacts system reliability and availability.

Summary

This vulnerability involves the Linux kernel's memcg subsystem where dying tasks bypass the reclaim and OOM killer once the oom_reaper has completed. The oom_reaper attempts to asynchronously free memory but gives up if it cannot acquire the mmap_lock in read mode, setting a flag (MMF_OOM_SKIP) that prevents further asynchronous reclaim attempts. Consequently, many threads of the OOM-killed process become serialized behind the oom_lock, leading to excessive delays in process exit. The problem was observed with large memory limits and zswap enabled, where thousands of threads were stuck waiting on memory charge operations. A patch was introduced to fail memory charge attempts for dying tasks after the oom_reaper is done, reducing exit times from about 90 seconds to 3 seconds in tests.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:59 UTC

Technical details

References

Community reviews

Related threats