Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a memory leak. By repeatedly triggering specific memory policy settings, an attacker could gradually consume system memory, potentially leading to performance degradation or a system crash. This affects systems using the 'weighted interleave' memory auto-tuning feature.
Technical details
A memory leak vulnerability exists in mm/mempolicy.c within the weighted_interleave_auto_store() function. The root cause is improper management of memory state pointers (old_wi_state and new_wi_state) during mode transitions. Specifically, when a user writes 'false' while already in manual mode, the function returns early without freeing new_wi_state. Additionally, when writing 'true', the old state is overwritten via rcu_assign_pointer() without being freed because the fetch of the old state was conditionally skipped. A local attacker with permissions to modify these sysfs-like attributes can trigger these leaks in a loop to exhaust kernel memory. The fix involves moving the old state fetch before the input check to ensure proper cleanup and unified early returns.
Affected products
- Linux Linux Kernel v6.16+
Timeline
- 2026-04-01: other: Initial patch submitted by Jackie Liu
- 2026-05-27: advisory: CVE-2026-46042 published