CVE-2026-53162

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> memcg: use round-robin victim selection in refill_stock<br /> <br /> Harry Yoo reported that get_random_u32_below() is not safe to call in the<br /> nmi context and memcg charge draining can happen in nmi context.<br /> <br /> More specifically get_random_u32_below() is neither reentrant- nor<br /> NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave() on the<br /> batched_entropy_u32 state. An NMI that lands on a CPU mid-update of the<br /> ChaCha batch state and recurses into the random subsystem would corrupt<br /> that state. The memcg_stock local_trylock prevents re-entry on the percpu<br /> stock itself, but cannot protect an unrelated subsystem&amp;#39;s per-cpu lock.<br /> <br /> Replace the random pick with a per-cpu round-robin counter stored in<br /> memcg_stock_pcp and serialized by the same local_trylock that already<br /> guards cached[] and nr_pages[]. No atomics, no random calls, no extra<br /> locks needed.