CVE-2026-46042: mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()
In the Linux kernel, the following vulnerability has been resolved:
mm/mempolicy: fix memory leaks in weightedinterleaveautostore()
weightedinterleaveautostore() fetches oldwistate inside the if (!input) block only. This causes two memory leaks:
1. When a user writes "false" and the current mode is already manual, the function returns early without freeing the freshly allocated newwistate.
2. When a user writes "true", oldwistate stays NULL because the fetch is skipped entirely. The old state is then overwritten by rcuassignpointer() but never freed, since the cleanup path is gated on oldwistate being non-NULL. A user can trigger this repeatedly by writing "1" in a loop.
Fix both leaks by moving the oldwistate fetch before the input check, making it unconditional. This also allows a unified early return for both "true" and "false" when the requested mode matches the current mode.
Reviewed by: Donet Tom <donettom@linux.ibm.com>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Apply the upstream code fix that moves the old_wi_state fetch before the input check in mm/mempolicy:weighted_interleave_auto_store() to eliminate the two memory leaks (as described in the remedy text).
Event History
Frequently Asked Questions
What access does an attacker need to trigger the issue?
Systems are exposed when a local user with the required ability to write the weighted interleave auto setting can repeatedly change that setting. The CVSS vector identifies local access and low privileges as required; no user interaction is required.
How could this be abused to affect availability?
Repeated writes of "1" can leak the prior weighted interleave state on each write. Writing "false" can also leak a newly allocated state when the current mode is already manual.
What mitigation is available before updating the kernel?
If patching cannot be applied immediately, restrict access to the interface that controls weighted_interleave_auto and prevent untrusted local users or workloads from repeatedly writing "1" or toggling the setting. This reduces the ability to accumulate leaked memory.