Skip to main content

Linux Kernel CVE-2026-46279

| EUVDEUVD-2026-35144 HIGH
Double Free (CWE-415)
2026-06-08 Linux GHSA-q7fc-6xm7-37m9
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Boot kernel with MEM_ALLOC_PROFILING_DEBUG enabled
  2. Delivery
    Early pages allocated before page_ext init
  3. Exploit
    Pages freed via KASAN quarantine reclaim
  4. Execution
    Missing codetag ref hits __pgalloc_tag_sub assertion
  5. Impact
    Kernel WARNING splat logged

Vulnerability Assessment

Weakness
CWE
CWE-415
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
Exploitation Conditions

Requires the kernel to be compiled with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and with mem_profiling_compressed disabled - an explicit non-default debug build. It is further gated by boot-time initialization ordering in which pages are allocated (e.g. init_section_page_ext -> alloc_page_ext -> kmemleak_alloc buddy fallback) before page_ext is fully initialized and then freed afterward (observed via KASAN quarantine reduction). Limiting factors: the vector is local (AV:L), the trigger is internal kernel boot activity rather than attacker-supplied input, and production kernels without the debug option or with mem_profiling_compressed enabled do not exhibit the behavior at all. No remote or unauthenticated path exists.
Impact

The signals converge on low real-world risk despite the 7.8 CVSS. The published vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the Linux kernel CNA's generic high-impact template and is inconsistent with the described behavior, which is a kernel WARNING that only appears with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled - a non-default debugging build, not production kernels. EPSS is 0.02% (4th percentile), there is no KEV listing, and no public exploit is identified at time of analysis, all consistent with negligible exploitation interest. The C:H/I:H/A:H rating is not substantiated by the description, which shows an accounting warning rather than memory corruption leading to code execution or disclosure, and the 'Information Disclosure' tag is likewise unsupported by the described mechanism. Conflict to note: CVSS claims full CIA impact but the description implies only a debug-only warning - verify with the vendor before treating this as a high priority.
Exploit ScenarioDerived

On a system running a kernel built with allocation-profiling debug enabled, normal early-boot activity - such as KASAN quarantine reclaim freeing pages that were allocated before page_ext was ready - causes __pgalloc_tag_sub to hit the 'alloc_tag was not set' assertion and emit a WARNING with a stack trace. No attacker action is required to reproduce it, and no memory-corruption primitive or code execution is demonstrated; no public exploit has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Improper handling of allocation-profiling codetags in the Linux kernel's mm/alloc_tag subsystem causes an 'alloc_tag was not set' WARNING when pages allocated before page_ext initialization are later freed, because their codetag reference was never set. This affects local systems running kernels built with the debug option CONFIG_MEM_ALLOC_PROFILING_DEBUG and with mem_profiling_compressed disabled, and is triggered by ordinary boot-time activity (e.g. KASAN quarantine reclaim freeing early-allocated pages). It is classified under CWE-415 (double free) but the observed effect is a kernel warning splat; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).

RemediationAI

Upgrade to a patched kernel: vendor-released patches are available in stable 6.18.27, 7.0.4, and mainline 7.1-rc1, and via distribution updates Ubuntu USN-8489-1 (https://ubuntu.com/security/notices/USN-8489-1) and USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1). If maintaining a custom kernel, apply upstream commit d5b495ba9de0, b49dfabc38ca, or 6b1842775a46 from git.kernel.org/stable. Because the warning only occurs when the kernel is built with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled, a zero-code workaround is to build or run a kernel without CONFIG_MEM_ALLOC_PROFILING_DEBUG (or enable mem_profiling_compressed); the trade-off is loss of allocation-profiling debug diagnostics, which is acceptable on production systems that do not need them. Standard production kernels that do not enable this debug option are not affected and need only routine patching.

Affected VersionsENISA

Linux patch: 6.18.27
Linux dcfe378c81f72f146890ce1dcfdcc742d3b66924 <d5b495ba9de0423ef39f8bd86729a885870c7efe
Linux patch: 7.1-rc1
Linux dcfe378c81f72f146890ce1dcfdcc742d3b66924 <b49dfabc38cad5e50af24f63edd124a10de3ebb6
Linux 6.10
Linux dcfe378c81f72f146890ce1dcfdcc742d3b66924 <6b1842775a460245e97d36d3a67d0cfba7c4ff79
Linux patch: 0
Linux patch: 7.0.4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the kernel memory allocation profiling infrastructure (mm/alloc_tag), which relies on page_ext to store per-page 'codetag' metadata attributing allocations to their source location. Because page_ext is initialized relatively late during boot, some pages are allocated and freed before it is available - for example init_section_page_ext() -> alloc_page_ext() -> kmemleak_alloc() can fall back to the buddy allocator when the slab cache has no free objects. Those pages carry no codetag, so when they are later freed (here via KASAN quarantine reduction: kasan_quarantine_reduce -> qlist_free_all -> __free_frozen_pages -> __pgalloc_tag_sub) the assertion at include/linux/alloc_tag.h:164 fires. The fix records such early pages in a fixed 8192-entry global array and clears their codetag to empty once page_ext initialization completes, warning if the array overflows. The CWE-415 (double free) label describes the mismatched alloc/free accounting of the codetag reference rather than a classic exploitable heap double-free.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 2.5 LOW

Local, debug-only build plus a boot-timing race gives AV:L/AC:H/PR:L; observed impact is a kernel warning (minor availability noise) with no confidentiality or integrity loss, so C:N/I:N/A:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 15:07 NVD
7.8 (HIGH)
Patch available
Jun 08, 2026 - 18:01 EUVD
CVE Published
Jun 08, 2026 - 15:41 nvd
HIGH 7.8
CVE Published
Jun 08, 2026 - 15:41 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/alloc_tag: clear codetag for pages allocated before page_ext initialization

Due to initialization ordering, page_ext is allocated and initialized relatively late during boot. Some pages have already been allocated and freed before page_ext becomes available, leaving their codetag uninitialized.

A clear example is in init_section_page_ext(): alloc_page_ext() calls kmemleak_alloc(). If the slab cache has no free objects, it falls back to the buddy allocator to allocate memory. However, at this point page_ext is not yet fully initialized, so these newly allocated pages have no codetag set. These pages may later be reclaimed by KASAN, which causes the warning to trigger when they are freed because their codetag ref is still empty.

Use a global array to track pages allocated before page_ext is fully initialized. The array size is fixed at 8192 entries, and will emit a warning if this limit is exceeded. When page_ext initialization completes, set their codetag to empty to avoid warnings when they are freed later.

This warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled:

[ 9.582133] ------------[ cut here ]------------ [ 9.582137] alloc_tag was not set [ 9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1 [ 9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy) [ 9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550 [ 9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 <67> 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7 [ 9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246 [ 9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c [ 9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460 [ 9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324 [ 9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00 [ 9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360 [ 9.582206] FS: 00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000 [ 9.582208] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0 [ 9.582211] PKRU: 55555554 [ 9.582212] Call Trace: [ 9.582213] <TASK> [ 9.582214] ? __pfx___pgalloc_tag_sub+0x10/0x10 [ 9.582216] ? check_bytes_and_report+0x68/0x140 [ 9.582219] __free_frozen_pages+0x2e4/0x1150 [ 9.582221] ? __free_slab+0xc2/0x2b0 [ 9.582224] qlist_free_all+0x4c/0xf0 [ 9.582227] kasan_quarantine_reduce+0x15d/0x180 [ 9.582229] __kasan_slab_alloc+0x69/0x90 [ 9.582232] kmem_cache_alloc_noprof+0x14a/0x500 [ 9.582234] do_getname+0x96/0x310 [ 9.582237] do_readlinkat+0x91/0x2f0 [ 9.582239] ? __pfx_do_readlinkat+0x10/0x10 [ 9.582240] ? get_random_bytes_user+0x1df/0x2c0 [ 9.582244] __x64_sys_readlinkat+0x96/0x100 [ 9.582246] do_syscall_64+0xce/0x650 [ 9.582250] ? __x64_sys_getrandom+0x13a/0x1e0 [ 9.582252] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 9.582254] ? do_syscall_64+0x114/0x650 [ 9.582255] ? ksys_read+0xfc/0x1d0 [ 9.582258] ? __pfx_ksys_read+0x10/0x10 [ 9.582260] ? do_syscall_64+0x114/0x650 [ 9.582262] ? do_syscall_64+0x114/0x650 [ 9.582264] ? __pfx_fput_close_sync+0x10/0x10 [ 9.582266] ? file_close_fd_locked+0x178/0x2a0 [ 9.582268] ? __x64_sys_faccessat2+0x96/0x100 [ 9.582269] ? __x64_sys_close+0x7d/0xd0 [ 9.582271] ? do_syscall_64+0x114/0x650 [ 9.582273] ? do_syscall_64+0x114/0x650 [ 9.582275] ? clear_bhb_loop+0x50/0xa0 [ 9.582277] ? clear_bhb_l ---truncated---

Executive ViewAI

Why It Matters

A Linux kernel vulnerability (CVE-2026-46279) causes erroneous system warning messages on systems with debug memory profiling enabled, affecting alert and log management accuracy. No public exploit identified at time of analysis; exploitability is negligible (EPSS 0.0%) and limited to systems with specific debug configurations. Organizational risk is minimal and primarily affects diagnostic systems rather than production security posture.

Business Impact: Low
Compensating Controls

Apply vendor patch. Interim: Systems without CONFIG_MEM_ALLOC_PROFILING_DEBUG enabled in kernel configuration are unaffected; disabling this debug feature at compile time mitigates exposure.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel runs on the vast majority of server and cloud systems
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46279 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/369236 REF https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79 REF https://git.kernel.org/stable/c/b49dfabc38cad5e50af24f63edd124a10de3ebb6 REF https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy