# CVE-2026-98225: linux: In the Linux kernel, the following vulnerability has been resolved:  mm/shrinker: fix bogus set_shrinker_bit() with c...

CVE-2026-98225 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98225 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98225
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem  With cgroup.memory=nokmem, shrinker_memcg_alloc() bails out early and never allocates an id, so shrinker->id keeps the 0 it got from the kzalloc() in shrinker_alloc().  __list_lru_init() then copies that 0 into lru->shrinker_id, where it looks like a valid bit index.  Nothing calls expand_shrinker_info() on nokmem either, so shrinker_nr_max stays 0 and every memcg ends up with an empty map (map_nr_max == 0).  deferred_split_folio() hands a real memcg to __list_lru_add() regardless of whether the lru is memcg aware, so the first THP queued in a cgroup does set_shrinker_bit(memcg, nid, 0) and trips the bounds check:  WARNING: mm/shrinker.c:212 at set_shrinker_bit+0x7d/0x90, CPU#126 Call Trace:  <TASK>  deferred_split_folio+0x18c/0x220  map_anon_folio_pmd_nopf+0xdd/0x130  map_anon_folio_pmd_pf+0x14/0xb0  do_huge_pmd_anonymous_page+0x1a1/0x620  __handle_mm_fault+0xea9/0x10d0  handle_mm_fault+0xe5/0x320  do_user_addr_fault+0x1cc/0x870  exc_page_fault+0x81/0x1b0  asm_exc_page_fault+0x27/0x30  </TASK>  Harmless, the WARN_ON_ONCE() is what keeps the out of bounds unit[] read from happening, but the id should not look valid in the first place.  Clear it before returning.  Two other spots could paper over this: drop the id in __list_lru_init() when nokmem turns memcg_aware off, or make deferred_split_folio() pass NULL like list_lru_add_obj() does.  Both leave shrinker->id lying around for the next caller, so fix it where the id is handed out.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98225](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98225.md) | Oct 6, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.