CVE-2026-74576

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: prevent unbounded recursion in free path with new kmalloc type

Commit 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from

its own slab") avoided recursive allocation of obj_exts from kmalloc

caches of the same size, by bumping the obj_exts array's allocation

size whenever the array size equals the size of the object being

allocated.

However, as reported by Danielle Costantino and Shakeel Butt,

even slabs from kmalloc caches of different sizes can form a cycle

by allocating obj_exts arrays from each other [1]:

What happened: a KMALLOC_NORMAL slab's obj_exts array (used by

allocation profiling / memcg accounting) is itself kmalloc()'d from a

KMALLOC_NORMAL cache, so the "slab holds another slab's obj_exts array"

relation can form cycles. With sizeof(struct slabobj_ext) == 16 and

the host's geometry:

- kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes,

served from km

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References