CVE-2026-98414

A low severity flaw was found in the Linux kernel's memory control group (memcg) subsystem. When a direct child of the root control group is removed, its object charges are reparented to the root memcg. Because obj_cgroup_charge_pages() does not short-circuit the root memcg, subsequent memory reclamation of the reparented pages (demonstrated through zswap) charges them to the root memcg and triggers a kernel WARNING in refill_stock(). As the corresponding uncharge path skips the root memcg, the root's page counter grows without ever being uncharged, resulting in an internal memory accounting leak that is not directly user-visible, since memory.current is not exposed for the root cgroup. Exploitation requires local access with administrative (root) privileges, because triggering the issue involves creating and removing a direct child of the root cgroup and triggering proactive memory reclaim on the root cgroup; the practical consequence is kernel warning output and an internal accounting leak rather than memory exhaustion or a system crash, which is reflected in the low Red Hat severity rating. Among Red Hat products, the vulnerable code is present only in the Red Hat Enterprise Linux 10 kernel streams rhel-10.3.z and rhel-10.4 and in the Red Hat In-Vehicle OS 2 kernel streams; other Red Hat Enterprise Linux streams (including rhel-10.0.z and rhel-10.2.z) and the OpenShift Container Platform RHCOS kernels are not affected because the vulnerable code is not present in those versions. For the affected streams the fix is deferred to a future update given the low severity and the limited practical impact of the flaw; the residual risk is that a privileged local user performing this specific cgroup removal and reclaim sequence can generate kernel warnings and an internal, non-user-visible accounting leak on the root memcg.