Improper initialization in Linux kernel - CVE-2026-98920

Vulnerability details

The vulnerability allows a local user to trigger kernel warnings and cause memory allocations to be omitted from allocation profiling records.

The vulnerability exists due to improper initialization of allocation tags in the Linux kernel netfs allocation paths when processing file operations that directly invoke mempool allocation callbacks. A local user can read files on a CIFS mount to exercise allocations that bypass alloc_hooks(), leaving current->alloc_tag unset and causing allocation profiling omissions and kernel warnings.

The allocation and free warnings occur with CONFIG_MEM_ALLOC_PROFILING_DEBUG=y.

Affected software

How to mitigate CVE-2026-98920

External References

• https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8
• https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d
• https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2

Related Security Bulletins

• Improper initialization in Linux kernel netfs direct mempool allocation paths in fs/netfs/objects.c and fs/netfs/rolling_buffer.c
• Debian update for linux