CVE-2026-46279 (GCVE-0-2026-46279)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:41 – Updated: 2026-06-14 18:05
VLAI
Title
mm/alloc_tag: clear codetag for pages allocated before page_ext initialization
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Due to initialization ordering, page_ext is allocated and initialized relatively late during boot. Some pages have already been allocated and freed before page_ext becomes available, leaving their codetag uninitialized. A clear example is in init_section_page_ext(): alloc_page_ext() calls kmemleak_alloc(). If the slab cache has no free objects, it falls back to the buddy allocator to allocate memory. However, at this point page_ext is not yet fully initialized, so these newly allocated pages have no codetag set. These pages may later be reclaimed by KASAN, which causes the warning to trigger when they are freed because their codetag ref is still empty. Use a global array to track pages allocated before page_ext is fully initialized. The array size is fixed at 8192 entries, and will emit a warning if this limit is exceeded. When page_ext initialization completes, set their codetag to empty to avoid warnings when they are freed later. This warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled: [ 9.582133] ------------[ cut here ]------------ [ 9.582137] alloc_tag was not set [ 9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1 [ 9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy) [ 9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550 [ 9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 <67> 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7 [ 9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246 [ 9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c [ 9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460 [ 9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324 [ 9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00 [ 9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360 [ 9.582206] FS: 00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000 [ 9.582208] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0 [ 9.582211] PKRU: 55555554 [ 9.582212] Call Trace: [ 9.582213] <TASK> [ 9.582214] ? __pfx___pgalloc_tag_sub+0x10/0x10 [ 9.582216] ? check_bytes_and_report+0x68/0x140 [ 9.582219] __free_frozen_pages+0x2e4/0x1150 [ 9.582221] ? __free_slab+0xc2/0x2b0 [ 9.582224] qlist_free_all+0x4c/0xf0 [ 9.582227] kasan_quarantine_reduce+0x15d/0x180 [ 9.582229] __kasan_slab_alloc+0x69/0x90 [ 9.582232] kmem_cache_alloc_noprof+0x14a/0x500 [ 9.582234] do_getname+0x96/0x310 [ 9.582237] do_readlinkat+0x91/0x2f0 [ 9.582239] ? __pfx_do_readlinkat+0x10/0x10 [ 9.582240] ? get_random_bytes_user+0x1df/0x2c0 [ 9.582244] __x64_sys_readlinkat+0x96/0x100 [ 9.582246] do_syscall_64+0xce/0x650 [ 9.582250] ? __x64_sys_getrandom+0x13a/0x1e0 [ 9.582252] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 9.582254] ? do_syscall_64+0x114/0x650 [ 9.582255] ? ksys_read+0xfc/0x1d0 [ 9.582258] ? __pfx_ksys_read+0x10/0x10 [ 9.582260] ? do_syscall_64+0x114/0x650 [ 9.582262] ? do_syscall_64+0x114/0x650 [ 9.582264] ? __pfx_fput_close_sync+0x10/0x10 [ 9.582266] ? file_close_fd_locked+0x178/0x2a0 [ 9.582268] ? __x64_sys_faccessat2+0x96/0x100 [ 9.582269] ? __x64_sys_close+0x7d/0xd0 [ 9.582271] ? do_syscall_64+0x114/0x650 [ 9.582273] ? do_syscall_64+0x114/0x650 [ 9.582275] ? clear_bhb_loop+0x50/0xa0 [ 9.582277] ? clear_bhb_l ---truncated---
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dcfe378c81f72f146890ce1dcfdcc742d3b66924 , < d5b495ba9de0423ef39f8bd86729a885870c7efe (git)
Affected: dcfe378c81f72f146890ce1dcfdcc742d3b66924 , < b49dfabc38cad5e50af24f63edd124a10de3ebb6 (git)
Affected: dcfe378c81f72f146890ce1dcfdcc742d3b66924 , < 6b1842775a460245e97d36d3a67d0cfba7c4ff79 (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.18.27 , ≤ 6.18.* (semver)
Unaffected: 7.0.4 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/alloc_tag.h",
            "include/linux/pgalloc_tag.h",
            "lib/alloc_tag.c",
            "mm/page_alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5b495ba9de0423ef39f8bd86729a885870c7efe",
              "status": "affected",
              "version": "dcfe378c81f72f146890ce1dcfdcc742d3b66924",
              "versionType": "git"
            },
            {
              "lessThan": "b49dfabc38cad5e50af24f63edd124a10de3ebb6",
              "status": "affected",
              "version": "dcfe378c81f72f146890ce1dcfdcc742d3b66924",
              "versionType": "git"
            },
            {
              "lessThan": "6b1842775a460245e97d36d3a67d0cfba7c4ff79",
              "status": "affected",
              "version": "dcfe378c81f72f146890ce1dcfdcc742d3b66924",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/alloc_tag.h",
            "include/linux/pgalloc_tag.h",
            "lib/alloc_tag.c",
            "mm/page_alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/alloc_tag: clear codetag for pages allocated before page_ext initialization\n\nDue to initialization ordering, page_ext is allocated and initialized\nrelatively late during boot.  Some pages have already been allocated and\nfreed before page_ext becomes available, leaving their codetag\nuninitialized.\n\nA clear example is in init_section_page_ext(): alloc_page_ext() calls\nkmemleak_alloc().  If the slab cache has no free objects, it falls back to\nthe buddy allocator to allocate memory.  However, at this point page_ext\nis not yet fully initialized, so these newly allocated pages have no\ncodetag set.  These pages may later be reclaimed by KASAN, which causes\nthe warning to trigger when they are freed because their codetag ref is\nstill empty.\n\nUse a global array to track pages allocated before page_ext is fully\ninitialized.  The array size is fixed at 8192 entries, and will emit a\nwarning if this limit is exceeded.  When page_ext initialization\ncompletes, set their codetag to empty to avoid warnings when they are\nfreed later.\n\nThis warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and\nmem_profiling_compressed disabled:\n\n[    9.582133] ------------[ cut here ]------------\n[    9.582137] alloc_tag was not set\n[    9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1\n[    9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy)\n[    9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[    9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550\n[    9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 \u003c67\u003e 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7\n[    9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246\n[    9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c\n[    9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460\n[    9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324\n[    9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00\n[    9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360\n[    9.582206] FS:  00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000\n[    9.582208] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0\n[    9.582211] PKRU: 55555554\n[    9.582212] Call Trace:\n[    9.582213]  \u003cTASK\u003e\n[    9.582214]  ? __pfx___pgalloc_tag_sub+0x10/0x10\n[    9.582216]  ? check_bytes_and_report+0x68/0x140\n[    9.582219]  __free_frozen_pages+0x2e4/0x1150\n[    9.582221]  ? __free_slab+0xc2/0x2b0\n[    9.582224]  qlist_free_all+0x4c/0xf0\n[    9.582227]  kasan_quarantine_reduce+0x15d/0x180\n[    9.582229]  __kasan_slab_alloc+0x69/0x90\n[    9.582232]  kmem_cache_alloc_noprof+0x14a/0x500\n[    9.582234]  do_getname+0x96/0x310\n[    9.582237]  do_readlinkat+0x91/0x2f0\n[    9.582239]  ? __pfx_do_readlinkat+0x10/0x10\n[    9.582240]  ? get_random_bytes_user+0x1df/0x2c0\n[    9.582244]  __x64_sys_readlinkat+0x96/0x100\n[    9.582246]  do_syscall_64+0xce/0x650\n[    9.582250]  ? __x64_sys_getrandom+0x13a/0x1e0\n[    9.582252]  ? __pfx___x64_sys_getrandom+0x10/0x10\n[    9.582254]  ? do_syscall_64+0x114/0x650\n[    9.582255]  ? ksys_read+0xfc/0x1d0\n[    9.582258]  ? __pfx_ksys_read+0x10/0x10\n[    9.582260]  ? do_syscall_64+0x114/0x650\n[    9.582262]  ? do_syscall_64+0x114/0x650\n[    9.582264]  ? __pfx_fput_close_sync+0x10/0x10\n[    9.582266]  ? file_close_fd_locked+0x178/0x2a0\n[    9.582268]  ? __x64_sys_faccessat2+0x96/0x100\n[    9.582269]  ? __x64_sys_close+0x7d/0xd0\n[    9.582271]  ? do_syscall_64+0x114/0x650\n[    9.582273]  ? do_syscall_64+0x114/0x650\n[    9.582275]  ? clear_bhb_loop+0x50/0xa0\n[    9.582277]  ? clear_bhb_l\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T18:05:55.795Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe"
        },
        {
          "url": "https://git.kernel.org/stable/c/b49dfabc38cad5e50af24f63edd124a10de3ebb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"
        }
      ],
      "title": "mm/alloc_tag: clear codetag for pages allocated before page_ext initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46279",
    "datePublished": "2026-06-08T15:41:21.972Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-06-14T18:05:55.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46279",
      "date": "2026-06-17",
      "epss": "0.00166",
      "percentile": "0.06171"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46279\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-08T17:16:45.530\",\"lastModified\":\"2026-06-08T17:16:45.530\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/alloc_tag: clear codetag for pages allocated before page_ext initialization\\n\\nDue to initialization ordering, page_ext is allocated and initialized\\nrelatively late during boot.  Some pages have already been allocated and\\nfreed before page_ext becomes available, leaving their codetag\\nuninitialized.\\n\\nA clear example is in init_section_page_ext(): alloc_page_ext() calls\\nkmemleak_alloc().  If the slab cache has no free objects, it falls back to\\nthe buddy allocator to allocate memory.  However, at this point page_ext\\nis not yet fully initialized, so these newly allocated pages have no\\ncodetag set.  These pages may later be reclaimed by KASAN, which causes\\nthe warning to trigger when they are freed because their codetag ref is\\nstill empty.\\n\\nUse a global array to track pages allocated before page_ext is fully\\ninitialized.  The array size is fixed at 8192 entries, and will emit a\\nwarning if this limit is exceeded.  When page_ext initialization\\ncompletes, set their codetag to empty to avoid warnings when they are\\nfreed later.\\n\\nThis warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and\\nmem_profiling_compressed disabled:\\n\\n[    9.582133] ------------[ cut here ]------------\\n[    9.582137] alloc_tag was not set\\n[    9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1\\n[    9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy)\\n[    9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\\n[    9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550\\n[    9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 \u003c67\u003e 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7\\n[    9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246\\n[    9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c\\n[    9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460\\n[    9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324\\n[    9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00\\n[    9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360\\n[    9.582206] FS:  00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000\\n[    9.582208] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[    9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0\\n[    9.582211] PKRU: 55555554\\n[    9.582212] Call Trace:\\n[    9.582213]  \u003cTASK\u003e\\n[    9.582214]  ? __pfx___pgalloc_tag_sub+0x10/0x10\\n[    9.582216]  ? check_bytes_and_report+0x68/0x140\\n[    9.582219]  __free_frozen_pages+0x2e4/0x1150\\n[    9.582221]  ? __free_slab+0xc2/0x2b0\\n[    9.582224]  qlist_free_all+0x4c/0xf0\\n[    9.582227]  kasan_quarantine_reduce+0x15d/0x180\\n[    9.582229]  __kasan_slab_alloc+0x69/0x90\\n[    9.582232]  kmem_cache_alloc_noprof+0x14a/0x500\\n[    9.582234]  do_getname+0x96/0x310\\n[    9.582237]  do_readlinkat+0x91/0x2f0\\n[    9.582239]  ? __pfx_do_readlinkat+0x10/0x10\\n[    9.582240]  ? get_random_bytes_user+0x1df/0x2c0\\n[    9.582244]  __x64_sys_readlinkat+0x96/0x100\\n[    9.582246]  do_syscall_64+0xce/0x650\\n[    9.582250]  ? __x64_sys_getrandom+0x13a/0x1e0\\n[    9.582252]  ? __pfx___x64_sys_getrandom+0x10/0x10\\n[    9.582254]  ? do_syscall_64+0x114/0x650\\n[    9.582255]  ? ksys_read+0xfc/0x1d0\\n[    9.582258]  ? __pfx_ksys_read+0x10/0x10\\n[    9.582260]  ? do_syscall_64+0x114/0x650\\n[    9.582262]  ? do_syscall_64+0x114/0x650\\n[    9.582264]  ? __pfx_fput_close_sync+0x10/0x10\\n[    9.582266]  ? file_close_fd_locked+0x178/0x2a0\\n[    9.582268]  ? __x64_sys_faccessat2+0x96/0x100\\n[    9.582269]  ? __x64_sys_close+0x7d/0xd0\\n[    9.582271]  ? do_syscall_64+0x114/0x650\\n[    9.582273]  ? do_syscall_64+0x114/0x650\\n[    9.582275]  ? clear_bhb_loop+0x50/0xa0\\n[    9.582277]  ? clear_bhb_l\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b49dfabc38cad5e50af24f63edd124a10de3ebb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.