The vulnerability in the Linux kernel's memory management shrinker code arises from a race condition between expand_shrinker_info() and the teardown of shrinker_info arrays. Specifically, alloc_shrinker_info() drops the shrinker_mutex before freeing partially initialized shrinker_info arrays during error cleanup, which can lead to concurrent access and double-free or use-after-free scenarios. The flaw affects the handling of memcg (memory control groups) during their online transition. The patch serializes the teardown process with shrinker_mutex and keeps error cleanup within the locked section to prevent these races.

This vulnerability can cause memory corruption in the kernel due to use-after-free or double-free conditions in the shrinker_info structures. Such corruption could potentially lead to system instability or crashes. No known exploits in the wild have been reported. The impact is limited to kernel memory management internals related to memory control groups.

A fix has been implemented that serializes shrinker_info teardown with the shrinker_mutex and keeps alloc_shrinker_info() error cleanup inside the locked section. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel security advisories for the latest remediation guidance.