SB20260816132 - Uncontrolled Recursion in Linux kernel mm

Description

This security bulletin contains information about 1 vulnerability.

1) Uncontrolled Recursion (CVE-ID: CVE-2026-74576)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the slab free path in mm/slub.c when freeing slab object extension arrays involved in cyclic kmalloc cache relationships. A local user can trigger memory allocation and freeing patterns to cause a denial of service.

Exploitation requires memory allocation profiling or slab object extension handling to be active, and the issue can exhaust the kernel stack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3e71bfbdd3fd81ee9fefd867fdb2be62bade4140
• https://git.kernel.org/stable/c/d01e88d421a6d07f35235600a43fbd0e551cf292
• https://git.kernel.org/stable/c/d9e6a7623938968e3752b67e37eaff097e559a54
• https://git.kernel.org/stable/c/ebefca49e4c69df24ba9307bfe0806230301d5c6