PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46279 Linux CVE debrief

A vulnerability was found in the Linux kernel, specifically in the mm/alloc_tag component. The issue arises due to the initialization ordering of page_ext, which is allocated and initialized relatively late during boot. Some pages have already been allocated and freed before page_ext becomes available, leaving their codetag uninitialized. This can cause a warning to trigger when these pages are later reclaimed by KASAN and freed because their codetag reference is still empty. The fix involves using a global array to track pages allocated before page_ext is fully initialized.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-08
Advisory published
2026-06-08
Advisory updated
2026-07-08

Who should care

Users of the Linux kernel who have CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled are affected by this vulnerability.

Technical summary

The vulnerability is caused by the initialization ordering of page_ext in the Linux kernel. The issue can be resolved by using a global array to track pages allocated before page_ext is fully initialized.

Defensive priority

Medium

Recommended defensive actions

  • Update the Linux kernel to the latest version that includes the fix for this vulnerability.
  • Enable CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and disable mem_profiling_compressed to prevent the warning from triggering.

Evidence notes

The CVE record for CVE-2026-46279 provides detailed information about the vulnerability, including its description, CVSS score, and references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46279 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46279

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46279 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46279

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b49dfabc38cad5e50af24f63edd124a10de3ebb6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.