CVE-2026-93197: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-36hf-5688-v4hm
Share
Published
Advisory Summary

CVE-2026-93197 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93197 at a Glance

CVE Identifier CVE-2026-93197
GHSA Identifier GHSA-36hf-5688-v4hm
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-93197

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93197, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvec_reparent_lru() splices the child's lists into the parent's and credits the parent with the child's per-zone lru_zone_size[], but never clears the child's copy, so the size is copied rather than moved. lru_gen_reparent_memcg() does the same for MGLRU. The parent is left correct, credited with exactly the folios it took over. The stale value sits on the child and nothing will correct it: folio->memcg_data now resolves to the parent, so every later update_lru_size() for those folios goes there. Dying cgroups are not freed immediately and mem_cgroup_iter() still walks them, so shrink_lruvec() keeps being called on them. get_scan_count() reads the phantom counter through lruvec_lru_size() and the scan loop then grinds through nr[] in SWAP_CLUSTER_MAX steps against an empty list, for as long as the dead cgroup lives. Under MGLRU the MGLRU scanner runs instead, but count_shadow_nodes() sums all of NR_LRU_LISTS through lruvec_lru_size() and over-budgets the shadow node limit just the same. On one 251 GiB host a sweep of every mz->lru_zone_size[] found 380 counters describing folios on no list at all: 124777314 pages, 476 GiB, 1.89x the machine's RAM, across 57 cgroups. All were on memcgs with CSS_DYING set and CSS_ONLINE clear, and parent/child pairs reported byte-identical sizes. LRU_UNEVICTABLE needs its size moved too. Its list is deliberately not spliced because lruvec_init() poisons the head - the unevictable LRU is imaginary and folios are never threaded on it - but the size is kept by lruvec_add_folio()/lruvec_del_folio() and those folios account to the parent from here on. This depends on commit bf4ade7dbd76 ("memcg: keep folio's objcg same as its node") and must not be backported ahead of it. Without that invariant a folio's objcg can belong to another node, so a folio already spliced onto the parent's list can still resolve to the child's lruvec until the objcg's node is reparented in a later iteration of memcg_reparent_objcgs(); clearing the child's counter early then lets lruvec_del_folio() underflow it and trip the WARN_ONCE()/VM_BUG_ON() in mem_cgroup_update_lru_size().

References

NVD — CVE-2026-93197 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93197
git.kernel.org/stable/c/007bc18423... WEB
https://git.kernel.org/stable/c/007bc1842317bb99f5f6205afede940f951674c2
git.kernel.org/stable/c/0e0ac326c5... WEB
https://git.kernel.org/stable/c/0e0ac326c511d514817cc7b6d7741afd59098ce2

Frequently Asked Questions

What is CVE-2026-93197?
CVE-2026-93197 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93197?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-93197?
CVE-2026-93197 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93197?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-36hf-5688-v4hm",
  "modified" : "2026-09-17T18:32:13Z",
  "published" : "2026-09-17T18:32:13Z",
  "aliases" : [ "CVE-2026-93197" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: move LRU size accounting on reparenting instead of copying it\n\nWhen a memory cgroup is offlined its LRU folios are reparented to the\nparent.  lruvec_reparent_lru() splices the child's lists into the\nparent's and credits the parent with the child's per-zone\nlru_zone_size[], but never clears the child's copy, so the size is\ncopied rather than moved.  lru_gen_reparent_memcg() does the same for\nMGLRU.\n\nThe parent is left correct, credited with exactly the folios it took\nover.  The stale value sits on the child and nothing will correct it:\nfolio->memcg_data now resolves to the parent, so every later\nupdate_lru_size() for those folios goes there.\n\nDying cgroups are not freed immediately and mem_cgroup_iter() still\nwalks them, so shrink_lruvec() keeps being called on them.\nget_scan_count() reads the phantom counter through lruvec_lru_size() and\nthe scan loop then grinds through nr[] in SWAP_CLUSTER_MAX steps against\nan empty list, for as long as the dead cgroup lives.  Under MGLRU the\nMGLRU scanner runs instead, but count_shadow_nodes() sums all of\nNR_LRU_LISTS through lruvec_lru_size() and over-budgets the shadow node\nlimit just the same.\n\nOn one 251 GiB host a sweep of every mz->lru_zone_size[] found 380\ncounters describing folios on no list at all: 124777314 pages, 476 GiB,\n1.89x the machine's RAM, across 57 cgroups.  All were on memcgs with\nCSS_DYING set and CSS_ONLINE clear, and parent/child pairs reported\nbyte-identical sizes.\n\nLRU_UNEVICTABLE needs its size moved too.  Its list is deliberately not\nspliced because lruvec_init() poisons the head - the unevictable LRU is\nimaginary and folios are never threaded on it - but the size is kept by\nlruvec_add_folio()/lruvec_del_folio() and those folios account to the\nparent from here on.\n\nThis depends on commit bf4ade7dbd76 (\"memcg: keep folio's objcg same as\nits node\") and must not be backported ahead of it.  Without that\ninvariant a folio's objcg can belong to another node, so a folio already\nspliced onto the parent's list can still resolve to the child's lruvec\nuntil the objcg's node is reparented in a later iteration of\nmemcg_reparent_objcgs(); clearing the child's counter early then lets\nlruvec_del_folio() underflow it and trip the WARN_ONCE()/VM_BUG_ON() in\nmem_cgroup_update_lru_size().",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93197"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/007bc1842317bb99f5f6205afede940f951674c2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0e0ac326c511d514817cc7b6d7741afd59098ce2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:18:15Z"
  }
}