CVE-2026-98920

netfs: Fix missing alloc tagging of direct mempool allocations

Published Oct 23, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix missing alloc tagging of direct mempool allocations

Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by
adding a mempool") added a mempool for the folio_queues and made the
request, subrequest and folio_queue allocations distinguish between
writeback and everything else. Writeback is part of memory reclaim
and must not fail due to ENOMEM, so it allocates under GFP_NOFS
through mempool_alloc(), which may dip into the pool's reserve and,
if that runs empty, wait for elements to be returned. The
GFP_KERNEL paths, which can return -ENOMEM to their callers, invoke
the pool's ->alloc() callback directly instead.

The direct call, however, skips the alloc_hooks() wrapper that the
mempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()
and mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()
and rely on current->alloc_tag having been set by the caller. With
CONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to

current->alloc_tag not set
WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook
alloc_tag was not set
WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook

at allocation and free time respectively, as reported when reading
files on a CIFS mount. The allocations are also missing from
/proc/allocinfo.

Wrap the direct ->alloc() invocations in alloc_hooks() with a new
mempool_alloc_noreserve() helper in include/linux/mempool.h, next to
the other alloc_hooks()-wrapped macros such as mempool_alloc(). The
GFP_KERNEL paths keep their failable allocation semantics, they just
get tagged now.

Analysis

Technical impact

The kernel bug arises from direct memory‑pool allocations that bypass the allocator hooks used for profiling. Because the current task’s allocation tag is never set, kernel space warnings are generated during CIFS file reads and the allocations are omitted from the profiling snapshot. The result is a noticeable degradation of system stability, log flooding, and the potential for resource exhaustion when the allocator falls back to the reserve pool or is unable to satisfy requests. The vulnerability does not provide a path to arbitrary code execution or data exfiltration.

Affected Systems

Affected systems include any Linux kernel that employs the netfs filesystem and the mempool allocator used for folio_queues. The defect is present in all kernel versions shipped before the commit that added mempool_alloc_noreserve – the patch is in the mainline kernel since March 2026. End‑users who run older kernels or pinned releases that have not incorporated this commit are susceptible.

Risk and Exploitability

The risk was quantified with a CVSS base score of 4.7, and the EPSS score is < 1%; therefore the exploitation probability is low. The vulnerability is not listed in CISA’s KEV catalog. Based on the described behavior, the most likely attack vector would involve a local attacker able to mount a CIFS share or otherwise trigger the faulty allocation code; remote exploitation is unlikely because the bug only manifests during normal kernel operation and does not provide an external interface that can be abused.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b343252d6f536203dd0660f676190dcbf6d2ecdc`	affected	< 6ba3d758cd40888908f96d68d69322dad65a871e
`15ed8a9b7c63e9171f5139a6aaa1ffb61809861f`	affected	< 5c03da745171485fd181f17b69213464f6d05f3d
`1d78d56c43ef3768183e8370e7367b162700e049`	affected	< 37a2042748bc880df03ff8315db86ed82991fbb8
`1d78d56c43ef3768183e8370e7367b162700e049`	affected	< b78b728e21c32ec4c330b299f657fb1eb02dffc2
`3f6d7f8a5416d852648d15a05e895f1195ee8a85`	affected	—
`6.12.114`	affected	< 6.12.117
`7.1.8`	affected	< 7.2

Linux

affected

Version	Status	Constraints
`7.2`	affected	—
`0`	unaffected	< 7.2
`6.12.117`	unaffected	≤ 6.12.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[15ed8a9b7c63e9171f5139a6aaa1ffb61809861f,5c03da745171485fd181f17b69213464f6d05f3d)`	affected	code_commit	—
`[1d78d56c43ef3768183e8370e7367b162700e049,37a2042748bc880df03ff8315db86ed82991fbb8)`	affected	code_commit	—
`[1d78d56c43ef3768183e8370e7367b162700e049,b78b728e21c32ec4c330b299f657fb1eb02dffc2)`	affected	code_commit	—
`b343252d6f536203dd0660f676190dcbf6d2ecdc`	affected	code_commit	—
`3f6d7f8a5416d852648d15a05e895f1195ee8a85`	affected	code_commit	—
`[6.12.114,6.13)`	affected	semver	—
`[7.1.8,7.2)`	affected	semver	—

Linux

Version	Status	Scheme	Platform
`7.2`	affected	generic	—
`[0,7.2)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[15ed8a9b7c63e9171f5139a6aaa1ffb61809861f,5c03da745171485fd181f17b69213464f6d05f3d)`	affected	code_commit	—
`[1d78d56c43ef3768183e8370e7367b162700e049,37a2042748bc880df03ff8315db86ed82991fbb8)`	affected	code_commit	—
`[1d78d56c43ef3768183e8370e7367b162700e049,b78b728e21c32ec4c330b299f657fb1eb02dffc2)`	affected	code_commit	—
`b343252d6f536203dd0660f676190dcbf6d2ecdc`	affected	code_commit	—
`3f6d7f8a5416d852648d15a05e895f1195ee8a85`	affected	code_commit	—
`[6.12.114,6.13)`	affected	semver	—
`[7.1.8,7.2)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.2`	affected	generic	—
`[0,7.2)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest Linux kernel that contains the commit introducing mempool_alloc_noreserve
If the kernel cannot be updated immediately, disable CONFIG_MEM_ALLOC_PROFILING_DEBUG to prevent the allocation‑tagging warnings from occurring
Monitor kernel logs for recurring allocation warning messages and verify that the alloc_tagging warnings have stopped

Generated by OpenCVE AI on October 29, 2026 at 13:43 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98920.mbox
https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8
https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d
https://git.kernel.org/stable/c/6ba3d758cd40888908f96d68d69322dad65a871e
https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2
https://nvd.nist.gov/vuln/detail/CVE-2026-98920
https://www.cve.org/CVERecord?id=CVE-2026-98920

History

Nov 10, 2026 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6ba3d758cd40888908f96d68d69322dad65a871e

Oct 29, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98920.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98920 https://www.cve.org/CVERecord?id=CVE-2026-98920
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 23, 2026 7:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 12:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else. Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned. The GFP_KERNEL paths, which can return -ENOMEM to their callers, invoke the pool's ->alloc() callback directly instead. The direct call, however, skips the alloc_hooks() wrapper that the mempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab() and mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof() and rely on current->alloc_tag having been set by the caller. With CONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to current->alloc_tag not set WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook alloc_tag was not set WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook at allocation and free time respectively, as reported when reading files on a CIFS mount. The allocations are also missing from /proc/allocinfo. Wrap the direct ->alloc() invocations in alloc_hooks() with a new mempool_alloc_noreserve() helper in include/linux/mempool.h, next to the other alloc_hooks()-wrapped macros such as mempool_alloc(). The GFP_KERNEL paths keep their failable allocation semantics, they just get tagged now.
Title		netfs: Fix missing alloc tagging of direct mempool allocations
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8 https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2