SB2026102403 - Improper initialization in Linux kernel netfs direct mempool allocation paths in fs/netfs/objects.c and fs/netfs/rolling_buffer.c

Description

This security bulletin contains information about 1 vulnerability.

1) Improper initialization (CVE-ID: CVE-2026-98920)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings and cause memory allocations to be omitted from allocation profiling records.

The vulnerability exists due to improper initialization of allocation tags in the Linux kernel netfs allocation paths when processing file operations that directly invoke mempool allocation callbacks. A local user can read files on a CIFS mount to exercise allocations that bypass alloc_hooks(), leaving current->alloc_tag unset and causing allocation profiling omissions and kernel warnings.

The allocation and free warnings occur with CONFIG_MEM_ALLOC_PROFILING_DEBUG=y.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8
• https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d
• https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2