CVE-2026-23219
Memory Tagging Warning in Linux Kernel Slab Allocator Causes Potential Allocation Issues
Publication date: 2026-02-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.10 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.10 (inc) to 6.12.70 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-772 | The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by adding the alloc_tagging_slab_free_hook() call to the memcg_alloc_abort_single() path in the Linux kernel.
Immediate mitigation steps include:
- Ensure that your Linux kernel is updated to a version that includes this fix.
- Enable CONFIG_MEM_ALLOC_PROFILING_DEBUG to monitor for related warnings.
- Monitor system logs for the warning message indicating the vulnerability.
If updating the kernel is not immediately possible, monitoring and alerting on the warning messages can help detect exploitation attempts.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's memory management subsystem related to slab allocation tagging when the CONFIG_MEM_ALLOC_PROFILING_DEBUG option is enabled.
Specifically, when the function __memcg_slab_post_alloc_hook() fails, there are two different paths for freeing memory depending on the size parameter. In one path (kmem_cache_free_bulk()), a function called alloc_tagging_slab_free_hook() is called to clear allocation tags properly. However, in the other path (memcg_alloc_abort_single()), this function was not called, which leads to allocation tags not being cleared.
This causes a warning message to appear during the next allocation, indicating that an allocation tag was not cleared properly. The fix involved adding the missing call to alloc_tagging_slab_free_hook() in the memcg_alloc_abort_single() path to ensure tags are cleared correctly.
How can this vulnerability impact me? :
This vulnerability can cause warning messages related to memory allocation tagging to appear in the kernel logs when CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled.
While the vulnerability does not describe a direct security exploit such as privilege escalation or denial of service, the improper clearing of allocation tags could potentially lead to confusion or misinterpretation during debugging or profiling of memory allocations.
In practical terms, this may impact system administrators or developers who rely on memory allocation profiling for debugging or performance analysis, as the warnings could indicate inconsistent or incorrect memory profiling data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for a specific warning message that appears when CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled.
The warning message to look for in the kernel logs is:
- [ 3959.023891] alloc_tag was not cleared (got tag for lib/xarray.c:378)
- [ 3959.023947] WARNING: ./include/linux/alloc_tag.h:155 at alloc_tag_add+0x128/0x178
To detect this, you can use commands such as:
- dmesg | grep 'alloc_tag was not cleared'
- journalctl -k | grep 'alloc_tag was not cleared'
- tail -f /var/log/kern.log | grep 'alloc_tag was not cleared'
These commands will help you identify if the warning related to this vulnerability is present in your system logs.