CVE-2026-23219: mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
In the Linux kernel, the following vulnerability has been resolved:
mm/slab: Add alloctaggingslabfreehook for memcgallocabortsingle
When CONFIGMEMALLOCPROFILINGDEBUG is enabled, the following warning may be noticed:
[ 3959.023862] ------------[ cut here ]------------ [ 3959.023891] alloctag was not cleared (got tag for lib/xarray.c:378) [ 3959.023947] WARNING: ./include/linux/alloctag.h:155 at alloctagadd+0x128/0x178, CPU#6: mkfs.ntfs/113998 [ 3959.023978] Modules linked in: dnsresolver tun brd overlay exfat btrfs blake2b libblake2b xor xorneon raid6pq loop sctp ip6udptunnel udptunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink srmod virtiogpu cdrom drmclientlib virtiodmabuf drmshmemhelper drmkmshelper ghashce drm sm4 backlight virtionet netfailover virtioscsi failover virtioconsole virtioblk virtiommio dmmirror dmregionhash dmlog dmmultipath dmmod i2cdev aesneonbs aesceblk [last unloaded: hwpoisoninject] [ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary) [ 3959.024182] Tainted: [W]=WARN [ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3959.024199] pc : alloctagadd+0x128/0x178 [ 3959.024207] lr : alloctagadd+0x128/0x178 [ 3959.024214] sp : ffff80008b696d60 [ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240 [ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860 [ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0 [ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000 [ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293 [ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000 [ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001 [ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838 [ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640 [ 3959.024340] Call trace: [ 3959.024346] alloctagadd+0x128/0x178 (P) [ 3959.024355] alloctaggingslaballochook+0x11c/0x1a8 [ 3959.024362] kmemcachealloclrunoprof+0x1b8/0x5e8 [ 3959.024369] xasalloc+0x304/0x4f0 [ 3959.024381] xascreate+0x1e0/0x4a0 [ 3959.024388] xasstore+0x68/0xda8 [ 3959.024395] filemapaddfolio+0x5b0/0xbd8 [ 3959.024409] filemapaddfolio+0x16c/0x7e0 [ 3959.024416] filemapgetfoliompol+0x2dc/0x9e8 [ 3959.024424] iomapgetfolio+0xfc/0x180 [ 3959.024435] iomapgetfolio+0x2f8/0x4b8 [ 3959.024441] iomapwritebegin+0x198/0xc18 [ 3959.024448] iomapwriteiter+0x2ec/0x8f8 [ 3959.024454] iomapfilebufferedwrite+0x19c/0x290 [ 3959.024461] blkdevwriteiter+0x38c/0x978 [ 3959.024470] vfswrite+0x4d4/0x928 [ 3959.024482] ksyswrite+0xfc/0x1f8 [ 3959.024489] arm64syswrite+0x74/0xb0 [ 3959.024496] invokesyscall+0xd4/0x258 [ 3959.024507] el0svccommon.constprop.0+0xb4/0x240 [ 3959.024514] doel0svc+0x48/0x68 [ 3959.024520] el0svc+0x40/0xf8 [ 3959.024526] el0t64synchandler+0xa0/0xe8 [ 3959.024533] el0t64sync+0x1ac/0x1b0 [ 3959.024540] ---[ end trace 0000000000000000 ]---
When memcgslabpostallochook() fails, there are two different free paths depending on whether size == 1 or size != 1. In the kmemcachefreebulk() path, we do call alloctaggingslabfreehook(). However, in memcgallocabortsingle() we don't, the above warning will be triggered on the next allocation.
Therefore, add alloctaggingslabfreehook() to the memcgallocabortsingle() path.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23219?
CVE-2026-23219 has a medium severity rating due to its potential impact on memory allocation debugging.
How do I fix CVE-2026-23219?
To address CVE-2026-23219, ensure that you are using an updated version of the Linux kernel where this vulnerability has been patched.
Which systems are affected by CVE-2026-23219?
CVE-2026-23219 affects systems running the Linux kernel with CONFIG_MEM_ALLOC_PROFILING_DEBUG enabled.
What type of vulnerability is CVE-2026-23219?
CVE-2026-23219 is a memory management vulnerability related to slab allocation in the Linux kernel.
Is CVE-2026-23219 remotely exploitable?
CVE-2026-23219 is not specifically noted as being remotely exploitable; it primarily affects system behavior during memory allocation under certain configurations.