Executive brief
The Linux kernel's memory allocator (slab allocator) can enter an infinite recursion loop when freeing memory blocks under certain allocation patterns, leading to stack exhaustion and system crashes. This issue affects production systems running memory allocation profiling, causing denial of service when specific kmalloc cache sizes trigger cycles in object extension array dependencies.
Technical details
The vulnerability is a recursion issue in the slab allocator's free path (mm/slab.c). When memory allocation profiling is enabled, object extension (obj_exts) arrays are allocated from kmalloc caches; due to specific cache geometry, a kmalloc-512 cache's obj_exts array (1024 bytes) is served from kmalloc-1k, while kmalloc-1k's obj_exts array (512 bytes) is served from kmalloc-512, forming a cycle. During __free_slab() → free_slab_obj_exts() → kfree() → discard_slab(), this cycle causes unbounded recursion until stack overflow. The attack vector is network (any remote or local memory allocation pattern) with no authentication required. The fix introduces a new KMALLOC_NO_OBJ_EXT cache type that serves obj_exts arrays from caches that cannot themselves have obj_exts, breaking the cycle.
Affected products
- Linux Linux Kernel versions with memory allocation profiling enabled
Timeline
- 2026-08-15: disclosed