CVE-2026-46279 Overview
CVE-2026-46279 is a Linux kernel issue in the memory allocation tagging subsystem (mm/alloc_tag). Pages allocated before page_ext initialization completes during early boot have uninitialized codetag references. When those pages are later freed, typically via the Kernel Address Sanitizer (KASAN) quarantine, the kernel triggers an alloc_tag was not set warning at __pgalloc_tag_sub. The condition is observable only when CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y is set and mem_profiling_compressed is disabled. The defect is a correctness and reliability problem in debug builds rather than a remotely reachable attack surface.
Critical Impact
The flaw produces kernel warnings on debug-enabled builds when pages allocated prior to page_ext initialization are freed, indicating uninitialized state in the memory allocation tagging path.
Affected Products
- Linux kernel builds with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y
- Linux kernel builds with mem_profiling_compressed disabled
- Kernels referenced by upstream stable commits 6b18427, b49dfab, and d5b495b
Discovery Timeline
- 2026-06-08 - CVE-2026-46279 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-46279
Vulnerability Analysis
The Linux kernel's allocation tagging facility records the source location (codetag) of each page allocation through the page_ext extension structure. Initialization ordering places page_ext setup relatively late in boot. Pages allocated before that point have no codetag reference assigned.
A concrete trigger occurs in init_section_page_ext(). The call into alloc_page_ext() invokes kmemleak_alloc(), which can fall back to the buddy allocator when its slab cache has no free objects. These buddy-allocated pages are produced while page_ext is still incomplete, so their codetag stays empty. When KASAN later reclaims these pages through its quarantine, __free_frozen_pages reaches __pgalloc_tag_sub and emits the alloc_tag was not set warning at include/linux/alloc_tag.h:164.
Root Cause
The root cause is an initialization-order defect: page allocations occur before the data structures that track their allocation tags are ready. The kernel did not previously reconcile these early allocations once page_ext became available, leaving stale empty references that the debug profiling path treats as anomalous on free.
Attack Vector
No network-reachable attack vector is associated with this CVE. The condition surfaces during normal system operation on kernels compiled with the memory allocation profiling debug option. Impact is limited to kernel log noise and developer-visible warnings on debug builds. The upstream commits referenced in the advisory address the issue in the mainline and stable trees.
The vulnerability manifests in the early-boot allocation path that runs before page_ext completes setup. See the Kernel Git Commit Fix for the patch implementation, and the related Kernel Git Commit Update and Kernel Git Commit Maintenance commits for additional context.
Detection Methods for CVE-2026-46279
Indicators of Compromise
- Kernel log entries containing the string alloc_tag was not set originating from __pgalloc_tag_sub.
- Warnings referencing include/linux/alloc_tag.h:164 during early userspace startup (for example, under systemd PID 1).
- Call traces showing __free_frozen_pages invoked from kasan_quarantine_reduce shortly after boot.
Detection Strategies
- Parse dmesg and persistent kernel logs for the alloc_tag was not set signature on debug kernels.
- Track recurrence of the warning across reboots to confirm it is initialization-order driven rather than a runtime regression.
- Correlate the warning with the kernel build configuration to verify whether CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled.
Monitoring Recommendations
- Forward kernel ring buffer output to centralized logging for fleet-wide visibility of WARNING entries from mm/alloc_tag.
- Alert on new occurrences of __pgalloc_tag_sub warnings following kernel upgrades or configuration changes.
- Include kernel version and configuration metadata in host inventory to identify systems still running unpatched debug kernels.
How to Mitigate CVE-2026-46279
Immediate Actions Required
- Apply the upstream fix from commit b49dfabc38cad5e50af24f63edd124a10de3ebb6 or update to a stable kernel release that includes it.
- Audit production kernels for the presence of CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and remove it from non-development builds.
- Rebuild and redeploy any custom kernels that incorporate the memory allocation profiling debug feature.
Patch Information
The fix introduces a fixed-size global array of 8192 entries that tracks pages allocated before page_ext initialization completes. Once page_ext is fully initialized, the kernel sets the codetag of those pages to empty, preventing the spurious warning on subsequent free. A warning is emitted only if the 8192-entry threshold is exceeded. Patches are available at the Kernel Git Commit Fix, Kernel Git Commit Update, and Kernel Git Commit Maintenance.
Workarounds
- Disable CONFIG_MEM_ALLOC_PROFILING_DEBUG in the kernel build configuration to suppress the diagnostic path that emits the warning.
- Enable mem_profiling_compressed if memory allocation profiling must remain active, since the warning is observed only when this mode is disabled.
- Restrict use of debug profiling kernels to non-production environments until the patched build is deployed.
# Verify whether the running kernel includes the debug profiling option
grep -E 'CONFIG_MEM_ALLOC_PROFILING_DEBUG|CONFIG_MEM_ALLOC_PROFILING' /boot/config-$(uname -r)
# Inspect kernel ring buffer for the warning signature
dmesg | grep -E 'alloc_tag was not set|__pgalloc_tag_sub'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
