CVE-2026-46279

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/alloc_tag: clear codetag for pages allocated before page_ext initialization

Due to initialization ordering, page_ext is allocated and initialized

relatively late during boot. Some pages have already been allocated and

freed before page_ext becomes available, leaving their codetag

uninitialized.

A clear example is in init_section_page_ext(): alloc_page_ext() calls

kmemleak_alloc(). If the slab cache has no free objects, it falls back to

the buddy allocator to allocate memory. However, at this point page_ext

is not yet fully initialized, so these newly allocated pages have no

codetag set. These pages may later be reclaimed by KASAN, which causes

the warning to trigger when they are freed because their codetag ref is

still empty.

Use a global array to track pages allocated before page_ext is fully

initialized. The array size is fixed at 8192 entries, and will emit a

warning if this limit is exceeded. When pag

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References