CVE-2026-53162

In the Linux kernel, the following vulnerability has been resolved:

memcg: use round-robin victim selection in refill_stock

Harry Yoo reported that getrandomu32_below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context.

More specifically getrandomu32below() is neither reentrant- nor NMI-safe: it acquires a per-cpu locallock via locallockirqsave() on the batchedentropyu32 state. An NMI that lands on a CPU mid-update of the ChaCha batch state and recurses into the random subsystem would corrupt that state. The memcgstock localtrylock prevents re-entry on the percpu stock itself, but cannot protect an unrelated subsystem's per-cpu lock.

Replace the random pick with a per-cpu round-robin counter stored in memcgstockpcp and serialized by the same localtrylock that already guards cached[] and nrpages[]. No atomics, no random calls, no extra locks needed.