CVE-2026-98920

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98920", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.380Z", "datePublished": "2026-10-23T12:02:06.560Z", "dateUpdated": "2026-11-10T18:15:20.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:20.857Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing alloc tagging of direct mempool allocations\n\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else. Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool's reserve and,\nif that runs empty, wait for elements to be returned. The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool's ->alloc() callback directly instead.\n\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current->alloc_tag having been set by the caller. With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to\n\n current->alloc_tag not set\n WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\n alloc_tag was not set\n WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\n\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount. The allocations are also missing from\n/proc/allocinfo.\n\nWrap the direct ->alloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc(). The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/objects.c", "fs/netfs/rolling_buffer.c", "include/linux/mempool.h"], "versions": [{"version": "b343252d6f536203dd0660f676190dcbf6d2ecdc", "lessThan": "6ba3d758cd40888908f96d68d69322dad65a871e", "status": "affected", "versionType": "git"}, {"version": "15ed8a9b7c63e9171f5139a6aaa1ffb61809861f", "lessThan": "5c03da745171485fd181f17b69213464f6d05f3d", "status": "affected", "versionType": "git"}, {"version": "1d78d56c43ef3768183e8370e7367b162700e049", "lessThan": "37a2042748bc880df03ff8315db86ed82991fbb8", "status": "affected", "versionType": "git"}, {"version": "1d78d56c43ef3768183e8370e7367b162700e049", "lessThan": "b78b728e21c32ec4c330b299f657fb1eb02dffc2", "status": "affected", "versionType": "git"}, {"version": "3f6d7f8a5416d852648d15a05e895f1195ee8a85", "status": "affected", "versionType": "git"}, {"version": "6.12.114", "lessThan": "6.12.117", "status": "affected", "versionType": "semver"}, {"version": "7.1.8", "lessThan": "7.2", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/objects.c", "fs/netfs/rolling_buffer.c", "include/linux/mempool.h"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.114", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6ba3d758cd40888908f96d68d69322dad65a871e"}, {"url": "https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d"}, {"url": "https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8"}, {"url": "https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}], "title": "netfs: Fix missing alloc tagging of direct mempool allocations", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/objects.c", "fs/netfs/rolling_buffer.c", "include/linux/mempool.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6ba3d758cd40888908f96d68d69322dad65a871e", "status": "affected", "version": "b343252d6f536203dd0660f676190dcbf6d2ecdc", "versionType": "git"}, {"lessThan": "5c03da745171485fd181f17b69213464f6d05f3d", "status": "affected", "version": "15ed8a9b7c63e9171f5139a6aaa1ffb61809861f", "versionType": "git"}, {"lessThan": "37a2042748bc880df03ff8315db86ed82991fbb8", "status": "affected", "version": "1d78d56c43ef3768183e8370e7367b162700e049", "versionType": "git"}, {"lessThan": "b78b728e21c32ec4c330b299f657fb1eb02dffc2", "status": "affected", "version": "1d78d56c43ef3768183e8370e7367b162700e049", "versionType": "git"}, {"status": "affected", "version": "3f6d7f8a5416d852648d15a05e895f1195ee8a85", "versionType": "git"}, {"lessThan": "6.12.117", "status": "affected", "version": "6.12.114", "versionType": "semver"}, {"lessThan": "7.2", "status": "affected", "version": "7.1.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/netfs/objects.c", "fs/netfs/rolling_buffer.c", "include/linux/mempool.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing alloc tagging of direct mempool allocations\n\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else. Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool's reserve and,\nif that runs empty, wait for elements to be returned. The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool's ->alloc() callback directly instead.\n\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current->alloc_tag having been set by the caller. With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to\n\n current->alloc_tag not set\n WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\n alloc_tag was not set\n WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\n\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount. The allocations are also missing from\n/proc/allocinfo.\n\nWrap the direct ->alloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc(). The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now."}], "id": "CVE-2026-98920", "lastModified": "2026-11-10T19:22:28.410", "metrics": {}, "published": "2026-10-23T13:17:12.617", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6ba3d758cd40888908f96d68d69322dad65a871e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfs: Fix missing alloc tagging of direct mempool allocations", "id": "2559652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559652"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfs: Fix missing alloc tagging of direct mempool allocations\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else. Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool's reserve and,\nif that runs empty, wait for elements to be returned. The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool's ->alloc() callback directly instead.\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current->alloc_tag having been set by the caller. With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to\ncurrent->alloc_tag not set\nWARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\nalloc_tag was not set\nWARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount. The allocations are also missing from\n/proc/allocinfo.\nWrap the direct ->alloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc(). The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now.", "A flaw was found in the Linux kernel's netfs subsystem. Direct memory pool allocations bypassed required memory tracking hooks when memory profiling debug features are active. A local user accessing files on a network file system can trigger repeated kernel warning messages, which may lead to a Denial of Service (DoS) on systems configured to halt on kernel warnings."], "name": "CVE-2026-98920", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98920\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98920\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98920.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15ed8a9b7c63e9171f5139a6aaa1ffb61809861f,5c03da745171485fd181f17b69213464f6d05f3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d78d56c43ef3768183e8370e7367b162700e049,37a2042748bc880df03ff8315db86ed82991fbb8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d78d56c43ef3768183e8370e7367b162700e049,b78b728e21c32ec4c330b299f657fb1eb02dffc2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b343252d6f536203dd0660f676190dcbf6d2ecdc"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3f6d7f8a5416d852648d15a05e895f1195ee8a85"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.114,6.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15ed8a9b7c63e9171f5139a6aaa1ffb61809861f,5c03da745171485fd181f17b69213464f6d05f3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d78d56c43ef3768183e8370e7367b162700e049,37a2042748bc880df03ff8315db86ed82991fbb8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d78d56c43ef3768183e8370e7367b162700e049,b78b728e21c32ec4c330b299f657fb1eb02dffc2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b343252d6f536203dd0660f676190dcbf6d2ecdc"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3f6d7f8a5416d852648d15a05e895f1195ee8a85"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.114,6.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T18:45:11.432087+00:00", "updated": "2026-10-29T13:45:17.580441+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-617"]}