CVE-2026-53162

In the Linux kernel, the following vulnerability has been resolved:

memcg: use round-robin victim selection in refill_stock

Harry Yoo reported that get_random_u32_below() is not safe to call in the

nmi context and memcg charge draining can happen in nmi context.

More specifically get_random_u32_below() is neither reentrant- nor

NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave() on the

batched_entropy_u32 state. An NMI that lands on a CPU mid-update of the

ChaCha batch state and recurses into the random subsystem would corrupt

that state. The memcg_stock local_trylock prevents re-entry on the percpu

stock itself, but cannot protect an unrelated subsystem's per-cpu lock.

Replace the random pick with a per-cpu round-robin counter stored in

memcg_stock_pcp and serialized by the same local_trylock that already

guards cached[] and nr_pages[]. No atomics, no random calls, no extra

locks needed.