CVE-2026-53162: Linux Kernel memcg NMI-Unsafe Random Number Generation Vulnerability

Technical summary

The vulnerability stems from unsafe use of get_random_u32_below() in the memcg charge draining code path (refill_stock). This function internally uses per-CPU local locks (local_lock_irqsave on batched_entropy_u32 state) to protect ChaCha batch state updates. When memcg_stock's local_trylock triggers charge draining during NMI context, a concurrent NMI can interrupt the random subsystem's per-CPU operations mid-update, corrupting the entropy state. While memcg_stock's own local_trylock prevents re-entry on the memcg structure, it cannot protect the unrelated random subsystem's per-CPU lock. The patch replaces get_random_u32_below() with a simple per-CPU round-robin counter stored in memcg_stock_pcp and serialized by the existing local_trylock, eliminating the atomics, random calls, and potential lock conflicts.

Business impact

This vulnerability could allow an unprivileged local user to trigger kernel memory management instability through crafted system calls or workloads that induce simultaneous NMI events and memcg charge draining. Potential consequences include kernel crashes, denial of service, information disclosure from freed memory pages, or privilege escalation if memory corruption affects security-sensitive kernel structures. Systems under high memory pressure or with frequent NMI activity (such as performance monitoring or watchdog timers) are at elevated risk.

Affected systems

The Linux kernel across all distributions is affected. The vulnerability exists in the memcg subsystem code path active on systems using kernel memory cgroup controls (common in containerized and multi-tenant environments). Systems using cgroups v1 or v2 with memory constraints are in scope. This includes cloud infrastructure, container orchestration platforms, and systems running resource-isolated workloads.

Exploitability

Exploitation requires local system access and the ability to trigger both NMI events and memory pressure conditions simultaneously. The vulnerability does not require special privileges to invoke memcg draining through normal memory allocation patterns, but reliably triggering the race condition requires specific timing and knowledge of system configuration. The attack surface is moderate; it requires local access but can be triggered through standard system calls without kernel module loading or special capabilities.

Remediation

Apply kernel updates that replace the get_random_u32_below() call in the refill_stock function with the round-robin counter mechanism. Verify patch application by confirming memcg_stock_pcp includes the round-robin counter variable and the refill_stock function no longer calls get_random_u32_below() for victim selection. No kernel parameters or configuration changes are required post-patch.

Patch guidance

Update to a Linux kernel version that includes the memcg refill_stock fix. Verify the upstream commit resolving this issue is included in your distribution's kernel release. For custom or vendor kernels, confirm the patch cherry-picked into your branch. After kernel update, reboot to activate the fix. No live patching workarounds are available; full reboot is required. Test in non-production environments first, particularly on systems with memory cgroup configurations.

Detection guidance

Monitor kernel logs for memory-related crashes or warnings such as 'memory cgroup charge drain' errors or ChaCha entropy state corruption messages. Track NMI-related kernel panics, especially those occurring during high memory pressure periods. Use performance monitoring to correlate memcg activity with NMI frequency. On patched systems, verify the round-robin counter mechanism is in use by inspecting kernel symbols and code paths. Intrusion detection systems should flag unusual patterns of system calls triggering memory pressure followed by CPU exceptions.

Why prioritize this

HIGH priority due to CVSS 7.8 score and the potential for denial of service or privilege escalation through memory corruption. The vulnerability affects core kernel memory management, impacts all Linux systems using cgroups, and requires only local access to trigger. While exploitation requires specific conditions (NMI + charge draining race), the widespread use of cgroups in production infrastructure and containerized environments increases practical risk. Recommend patching within standard security update cycles.

Risk score, explained

CVSS 7.8 reflects a HIGH severity local privilege escalation vulnerability with high impact to confidentiality, integrity, and availability. The attack vector is local (AV:L), attack complexity is low (AC:L), and privileges required are low (PR:L), indicating an unprivileged user can exploit this. The scope is unchanged (S:U) and all CIA impacts are rated high (C:H/I:H/A:H) due to potential kernel corruption affecting memory isolation and system stability. The score does not account for the race condition complexity, which reduces practical exploitability slightly but does not change the severity assessment.

Frequently asked questions