CVE-2026-23219: Linux Kernel Memory Allocation Vulnerability

CVE-2026-23219 Overview

A memory tag management vulnerability has been identified in the Linux kernel's memory management subsystem, specifically within the slab allocator. When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the kernel fails to properly clear allocation tags during certain memory free operations, resulting in warning messages and potentially inconsistent memory tracking state.

The vulnerability exists in the memcg_alloc_abort_single() path where alloc_tagging_slab_free_hook() is not called when __memcg_slab_post_alloc_hook() fails for single-element allocations. This differs from the kmem_cache_free_bulk() path which properly invokes the tagging hook, creating an inconsistency in memory allocation tracking.

Critical Impact

Improper allocation tag management in the Linux kernel slab allocator can trigger kernel warnings and potentially lead to inconsistent memory profiling state, affecting system stability and debugging capabilities.

Affected Products

• Linux kernel with CONFIG_MEM_ALLOC_PROFILING_DEBUG enabled
• Systems running affected kernel versions on ARM64 architecture
• Linux kernel memory management subsystem (mm/slab)

Discovery Timeline

• 2026-02-18 - CVE CVE-2026-23219 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23219

Vulnerability Analysis

This vulnerability affects the Linux kernel's memory allocation profiling mechanism, specifically within the slab allocator's memory control group (memcg) integration. The issue manifests when the __memcg_slab_post_alloc_hook() function fails during memory allocation operations.

The kernel's memory allocation profiling system uses allocation tags to track the source location of memory allocations for debugging and profiling purposes. When allocations are freed, the corresponding tags must be cleared to maintain consistency. However, the memcg_alloc_abort_single() function, which handles cleanup for failed single-element allocations, was missing the necessary call to alloc_tagging_slab_free_hook().

This oversight creates a code path divergence where bulk allocations (size != 1) properly clean up allocation tags via kmem_cache_free_bulk(), while single-element allocations fail to do so. The result is that allocation tags persist incorrectly, triggering warning messages like "alloc_tag was not cleared" on subsequent allocations to the same memory location.

Root Cause

The root cause is a missing alloc_tagging_slab_free_hook() call in the memcg_alloc_abort_single() function. When __memcg_slab_post_alloc_hook() fails for a single allocation (size == 1), the cleanup path differs from the bulk allocation path. The bulk path correctly invokes alloc_tagging_slab_free_hook() through kmem_cache_free_bulk(), but the single-allocation abort path was not updated to include this hook when the memory allocation profiling feature was introduced.

The warning stack trace shows the issue originates from alloc_tag_add() detecting a pre-existing tag (from lib/xarray.c:378) that should have been cleared, indicating the previous free operation did not properly clean up the allocation tracking metadata.

Attack Vector

This vulnerability is triggered through normal kernel operations when memory control group allocation post-hooks fail for single-element slab allocations. The vulnerable code path is exercised during:

• File system operations involving the XArray data structure
• Memory pressure conditions causing memcg allocation failures
• Any kernel subsystem performing slab allocations with memory profiling enabled

The vulnerability requires CONFIG_MEM_ALLOC_PROFILING_DEBUG to be enabled in the kernel configuration, which is typically used in development and debugging environments rather than production systems. The issue causes kernel warnings and inconsistent allocation tracking state but does not directly enable privilege escalation or code execution.

Detection Methods for CVE-2026-23219

Indicators of Compromise

• Kernel warning messages containing "alloc_tag was not cleared" in system logs
• Stack traces showing alloc_tag_add function with unexpected pre-existing tags
• Kernel taint flag [W]=WARN appearing in system information
• Repeated warnings from include/linux/alloc_tag.h:155 in dmesg output

Detection Strategies

• Monitor kernel logs (dmesg or /var/log/kern.log) for allocation tag warning messages
• Check for kernel taint flags using cat /proc/sys/kernel/tainted
• Verify kernel configuration for CONFIG_MEM_ALLOC_PROFILING_DEBUG status
• Use kernel live patching detection tools to identify unpatched systems

Monitoring Recommendations

• Implement centralized log collection for kernel warning messages across the infrastructure
• Configure alerting for kernel taint status changes on production systems
• Monitor for unusual patterns in slab allocator behavior using /proc/slabinfo
• Track kernel version deployments and correlate with known vulnerable versions

How to Mitigate CVE-2026-23219

Immediate Actions Required

• Apply the available kernel patches from the Linux kernel stable tree
• If patching is not immediately possible, consider disabling CONFIG_MEM_ALLOC_PROFILING_DEBUG in kernel configuration
• Rebuild and deploy the patched kernel to affected systems
• Monitor systems for kernel warnings indicating the vulnerability is being triggered

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds the missing alloc_tagging_slab_free_hook() call to the memcg_alloc_abort_single() path, ensuring consistent allocation tag cleanup across all free paths.

Available patches:

• Kernel Patch Commit b8bc725
• Kernel Patch Commit e6c53ea
• Kernel Patch Commit e8af57e

Workarounds

• Disable CONFIG_MEM_ALLOC_PROFILING_DEBUG in kernel configuration and rebuild if patching is delayed
• This configuration option is primarily used for development and debugging; production systems typically do not require it
• Monitor affected systems closely for kernel warnings until patches can be applied
• Consider using kernel live patching if available for your distribution

# Check if CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled
zcat /proc/config.gz | grep CONFIG_MEM_ALLOC_PROFILING_DEBUG

# Alternative method using kernel config file
grep CONFIG_MEM_ALLOC_PROFILING_DEBUG /boot/config-$(uname -r)

# Check current kernel version
uname -r

# View kernel taint status
cat /proc/sys/kernel/tainted