Skip to main content
← All vulnerabilities
CVE-2026-98920EUVD-2026-108884

netfs: Fix missing alloc tagging of direct mempool allocations

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.13, 7.2, 7.2.9
None on Exploit-DB, Metasploit or GitHub

Summary

The Linux kernel's network filesystem support (netfs), which CIFS and other network filesystems use, is affected. Kernels built with memory allocation profiling debugging enabled can log spurious warnings during file reads and writes, and some netfs allocations are missing from memory allocation statistics.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else. Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned. The GFP_KERNEL paths, which can return -ENOMEM to their callers, invoke the pool's ->alloc() callback directly instead. The direct call, however, skips the alloc_hooks() wrapper that the mempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab() and mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof() and rely on current->alloc_tag having been set by the caller. With CONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to current->alloc_tag not set WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook alloc_tag was not set WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook at allocation and free time respectively, as reported when reading files on a CIFS mount. The allocations are also missing from /proc/allocinfo. Wrap the direct ->alloc() invocations in alloc_hooks() with a new mempool_alloc_noreserve() helper in include/linux/mempool.h, next to the other alloc_hooks()-wrapped macros such as mempool_alloc(). The GFP_KERNEL paths keep their failable allocation semantics, they just get tagged now.

Timeline

  1. CVE published
  2. Record last updated
  3. First seen by cve.now

Affected versions

  • Linux Linux

    From 15ed8a9b7c63e9171f5139a6aaa1ffb61809861f · fixed in 5c03da745171485fd181f17b69213464f6d05f3d; From 1d78d56c43ef3768183e8370e7367b162700e049 · fixed in 37a2042748bc880df03ff8315db86ed82991fbb8; From 1d78d56c43ef3768183e8370e7367b162700e049 · fixed in b78b728e21c32ec4c330b299f657fb1eb02dffc2; From 6.12.114 · fixed in 6.13; From 7.1.8 · fixed in 7.2

  • Linux Linux

    7.2

  • KernelLinux

    From 7.2.0 · fixed in 7.2.9

References 3

git.kernel.org