In the Linux kernel, the following vulnerability has been resolved:

mm/page owner: use memcg data snapshot to avoid TOCTOU in print page owner memcg()

print page owner memcg() reads page->memcg data via READ ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg data locklessly in two places:

1: page memcg check(page)

2: PageMemcgKmem(page) (via folio memcg kmem(), which includes VM BUG ON assertions for tail pages and MEMCG DATA OBJEXTS)

If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM BUG ON assertions can trigger on CONFIG DEBUG VM=y builds, crashing the kernel.

Fix both TOCTOU issues by using the memcg data snapshot throughout.