CVE-2026-46279: Linux Kernel Memory Allocation Tracking Bug

Technical summary

The vulnerability stems from initialization-order dependencies in the Linux memory allocation profiling subsystem. The page_ext framework, which maintains per-page metadata including allocation tags (codetags), initializes relatively late during kernel boot. However, certain allocations—notably those triggered within init_section_page_ext() when kmemleak_alloc() falls back to the buddy allocator—occur before page_ext is fully initialized. These early-allocated pages lack associated codetags. Later, when KASAN reclaims and frees these pages, the __pgalloc_tag_sub() function detects a missing codetag reference and triggers a warning. The issue manifests only when CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and memory profiling compression is disabled. The fix implements a fixed-size global array (8192 entries) to track pages allocated before page_ext initialization completes, ensuring they receive empty codetag markers upon initialization completion to prevent warnings during subsequent deallocation.

Business impact

For production systems, this vulnerability poses a moderate risk. Systems running standard Linux kernels without memory profiling debugging enabled will not trigger the warning and are unaffected. However, organizations using kernel builds with CONFIG_MEM_ALLOC_PROFILING_DEBUG enabled—common in development, testing, and hardened security environments—may experience unexpected kernel warnings that could be misinterpreted as memory corruption, triggering false alarms or unnecessary system restarts. The vulnerability could complicate debugging efforts and undermine confidence in memory safety tooling. In worst-case scenarios where the tracking corruption propagates, undetected memory leaks or double-frees could occur.

Affected systems

The Linux kernel is affected. The vulnerability requires CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled to manifest. Systems running standard kernel configurations are unaffected; impact is limited to development kernels, testing environments, and specialized hardened deployments that explicitly enable memory allocation profiling debugging. The architecture appears platform-independent, though the stack trace references x86_64 systems.

Exploitability

This vulnerability is not directly exploitable by unprivileged users. The condition (CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y with profiling compression disabled) is a compile-time configuration unlikely to appear in production kernels. The warning triggers during specific boot-time memory allocation patterns and requires the KASAN allocator to reclaim pages. An attacker with kernel-module loading privileges might artificially trigger the condition, but the impact is limited to denial-of-service through kernel warnings rather than code execution or privilege escalation.

Remediation

Apply a kernel update that includes the fix for CVE-2026-46279. The patch modifies the page_ext initialization sequence to track early-allocated pages in a global array and retroactively assign empty codetags upon initialization completion. Organizations should verify the specific kernel version containing this fix against their vendor advisory. For systems running standard kernels without CONFIG_MEM_ALLOC_PROFILING_DEBUG enabled, no immediate action is required. For affected development and testing environments, patching should be prioritized to restore reliable memory profiling diagnostics.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing CVE-2026-46279. The fix is upstream in the Linux kernel; verify the specific version your distribution backports it to. If running a custom-built kernel with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y, rebuild with the patched source. Test patched kernels in non-production environments first, particularly if memory profiling or KASAN is critical to your security posture. The fix itself is minimal and low-risk, introducing only a fixed-size array allocation during boot.

Detection guidance

Monitor kernel logs for the warning 'alloc_tag was not set' appearing in dmesg or system logs, particularly during boot on systems with CONFIG_MEM_ALLOC_PROFILING_DEBUG enabled. The warning signature includes __pgalloc_tag_sub() in the stack trace. Security teams using KASAN or memory profiling tools should audit their kernel build configurations to identify which systems have the debug setting enabled. Use 'grep CONFIG_MEM_ALLOC_PROFILING_DEBUG /boot/config-$(uname -r)' to verify your running kernel's configuration. If warnings appear repeatedly, check if your kernel version precedes the fix.

Why prioritize this

Prioritize patching for systems with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y, as the warning indicates a real metadata corruption that could mask genuine memory safety issues. However, standard production kernels require no immediate action. The HIGH CVSS score reflects the local privilege requirement and impact on memory integrity; in practice, exploitability is low. Prioritize based on your environment: critical for development/testing kernels using memory profiling, low urgency for standard production deployments.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). However, this score is somewhat inflated by the debugging-focused nature of the vulnerability. The actual risk depends entirely on kernel configuration: with default configs, risk is negligible; with CONFIG_MEM_ALLOC_PROFILING_DEBUG, the high score appropriately reflects potential for undetected memory safety violations that could cascade into privilege escalation or data corruption.

Frequently asked questions