Executive brief
The Linux kernel's memory policy system, which distributes memory across multiple CPU nodes in servers and high-performance systems, contains a code defect that triggers sleeping function calls in atomic or RCU read-locked contexts. When the kernel attempts to rehash internal tables while holding read locks, this bug can cause kernel panics or system instability under specific memory allocation configurations.
Technical details
The vulnerability exists in the alloc_pages_bulk_weighted_interleave() function in mm/mempolicy.c. When rhashtable_insert_slow() calls bucket_table_alloc() under rcu_read_lock() with GFP_ATOMIC flags, and vmalloc is used for bucket table allocation, the code path eventually invokes alloc_pages_bulk_weighted_interleave(). The bug is that this function hardcodes GFP_KERNEL (which can sleep) when allocating a temporary weights array via kzalloc(), violating the constraint that no sleeping operations are allowed in atomic/RCU contexts. This triggers a might_alloc() splat reported by syzbot. The fix passes the received gfp flags (masked with GFP_RECLAIM_MASK) to kmalloc() instead of hardcoding GFP_KERNEL, respecting the caller's atomic context requirement.
Affected products
- Linux Linux Kernel kernels with MPOL_WEIGHTED_INTERLEAVE support (Linux 6.6 and later)
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: fix committed to stable kernel trees