CVE-2026-53162: Linux Kernel Race Condition Vulnerability

CVE-2026-53162 Overview

CVE-2026-53162 is a Linux kernel vulnerability in the memory control group (memcg) subsystem. The flaw resides in the refill_stock charge-draining path, which calls get_random_u32_below() to pick a victim CPU. That random helper is neither reentrant- nor non-maskable interrupt (NMI)-safe because it acquires a per-CPU local_lock via local_lock_irqsave() on the batched_entropy_u32 state. Since memcg charge draining can occur in NMI context, an NMI landing mid-update of the ChaCha batch state can corrupt the random subsystem's per-CPU state. The fix replaces the random victim pick with a per-CPU round-robin counter stored in memcg_stock_pcp.

Critical Impact
Re-entry into the random subsystem from NMI context can corrupt per-CPU entropy state, leading to kernel state inconsistency and potential instability on systems exercising memcg charge draining in NMI handlers.

Affected Products

Linux kernel (upstream) prior to the fix commit
Stable kernel branches containing the memcg refill_stock random victim selection logic
Distribution kernels derived from affected upstream versions

Discovery Timeline

2026-06-25 - CVE-2026-53162 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53162

Vulnerability Analysis

The Linux memory cgroup subsystem maintains a per-CPU cache of pre-charged pages in memcg_stock_pcp to amortize the cost of memory charging. When the stock needs to drain cached charges to other CPUs, refill_stock previously called get_random_u32_below() to select a victim CPU at random. Harry Yoo reported that this call path is unsafe when invoked from NMI context.

The issue is a re-entrancy violation rather than a memory safety bug. get_random_u32_below() acquires a per-CPU local_lock through local_lock_irqsave() to protect the batched_entropy_u32 ChaCha batch state. If an NMI fires while a thread holds that lock and recurses into the random subsystem, the batch state is corrupted. This is a class of [CWE-667] improper locking and [CWE-662] improper synchronization issue.

Root Cause

The memcg_stocklocal_trylock correctly prevents re-entry on the per-CPU stock itself, but it cannot protect an unrelated subsystem's per-CPU lock. The random subsystem's locking assumes callers are not in NMI context. Calling get_random_u32_below() from refill_stock violates that assumption because memcg charge draining is reachable from NMI handlers.

Attack Vector

This is a kernel concurrency defect rather than a directly exploitable user-facing flaw. Triggering the unsafe code path requires NMI-context memcg charge draining, which occurs during normal kernel operation on workloads using memory cgroups. The consequence is corrupted entropy batching state, which can affect random number generation correctness and kernel stability. No verified public proof-of-concept exists.

The upstream fix removes the random call entirely. It introduces a per-CPU round-robin counter stored in memcg_stock_pcp, serialized by the same local_trylock that already guards the cached[] and nr_pages[] arrays. No atomics, no random calls, and no extra locks are needed.

Detection Methods for CVE-2026-53162

Indicators of Compromise

Kernel warnings or lockdep splats referencing batched_entropy_u32 or local_lock_irqsave during memcg activity
Sporadic kernel instability on hosts running memory-cgroup-heavy workloads with NMI watchdog or perf NMI sampling enabled
Unexpected kernel panics traced back to the refill_stock or drain_stock call paths

Detection Strategies

Inventory running kernels with uname -r and compare against the patched stable releases referenced in the upstream commits
Monitor dmesg and journald for lockdep, RCU, or NMI-context warnings tied to memcg or the random subsystem
Audit container hosts and Kubernetes nodes, which heavily exercise memcg, for kernel build levels that include the fix

Monitoring Recommendations

Track kernel crash telemetry centrally and correlate stack traces containing refill_stock against deployed kernel versions
Enable CONFIG_PROVE_LOCKING in test environments to surface recurrence of similar NMI re-entry defects
Subscribe to distribution kernel security feeds to track backports of the three referenced upstream commits

How to Mitigate CVE-2026-53162

Immediate Actions Required

Identify all Linux hosts running kernel versions that predate the refill_stock round-robin fix
Prioritize patching multi-tenant container hosts where memcg pressure and NMI sampling co-occur
Stage and deploy distribution kernel updates that include the upstream commits referenced below

Patch Information

The fix replaces get_random_u32_below() in refill_stock with a per-CPU round-robin counter in memcg_stock_pcp, serialized by the existing local_trylock. Apply the upstream patches from the Kernel Git Commit c0cafe24, Kernel Git Commit 89bd8215, and Kernel Git Commit 00731bd7, or upgrade to a distribution kernel that includes them.

Workarounds

No supported in-kernel workaround exists short of applying the patch, since the unsafe call is in a core memcg path
Reduce exposure by limiting NMI sources (for example, perf sampling frequency) on critical hosts until patching is complete
Where feasible, schedule reboots into patched kernels via standard distribution update channels

bash

# Verify the running kernel and confirm the fix is present
uname -r

# On Debian/Ubuntu, apply available kernel updates
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# On RHEL/CentOS/Rocky/Alma, update the kernel package
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot