CVE-2026-53153

A race condition flaw in the Linux kernel's memory cgroup (memcg) list_lru subsystem has been rated as having IMPORTANT severity for affected Red Hat products. When a memory cgroup is destroyed, memcg_reparent_list_lrus() clears the dying cgroup's xarray entry before its per-node lists have been fully reparented to the parent cgroup. In this window, a concurrent list_lru_del() sees the cleared entry, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and unlinks an item that is still physically linked on the dying cgroup's list. If another in-flight thread (another list_lru_del() or a list_lru_walk_one() isolate callback) holds the dying cgroup's per-node lock at the same moment, both threads modify the ->next/->prev pointers of the same physical list under different locks, corrupting adjacent list entries. The verified consequence is kernel memory corruption, which can lead to system instability or a denial of service, and in the worst case may compromise confidentiality or integrity. Exploitation requires local access: a local user with low privileges who can create and remove memory cgroups while generating list_lru activity could trigger this flaw, but it depends on winning a narrow timing window (high attack complexity). Red Hat's severity of IMPORTANT with CVSS 3.1 score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the upstream CVE.org severity. The vulnerable per-cgroup list_lru locking code is present only in recent Red Hat kernel streams: Red Hat Enterprise Linux 6, 7, 8, 9, and 10.0 are not affected because the vulnerable code is not present, while Red Hat Enterprise Linux 10.2, 10.3, and Red Hat In-Vehicle OS 2 are affected, and a fix is being pursued for those products.