CVE-2026-23052: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23052 is a vulnerability in the Linux kernel's ftrace subsystem involving incorrect memory allocation calculations that can trigger kernel warnings. The flaw exists in ftrace_process_locs() and ftrace_allocate_records(), where the pg_remaining calculation incorrectly assumes ENTRIES_PER_PAGE * 2^order equals the actual capacity of an allocated page group, leading to over- or under-allocation of ftrace memory. This causes WARN() assertions to fire during kernel initialization. It was published on February 4, 2026, and is estimated to be of Medium severity with an EPSS score of 0.000180 (Feedly, CVE.org).

The root cause is an integer arithmetic error (related to CWE-682: Incorrect Calculation) in the Linux kernel's ftrace subsystem (kernel/trace/ftrace.c). ENTRIES_PER_PAGE is computed as PAGE_SIZE / ENTRY_SIZE using integer division; when PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g., 4096 / 24 = 170 remainder 16), high-order page allocations have more actual capacity than the formula accounts for. This causes pg_remaining to be underestimated, inflating the skip value and triggering WARN(skip != remaining) at lines 7276 and 7295 of ftrace.c. The fix involves using the actual capacity of each page group to determine allocation counts and having ftrace_allocate_pages() return the number of allocated pages directly (Feedly, Kernel Patch 1, Kernel Patch 2).

The primary impact is kernel stability: the miscalculation triggers WARN() assertions during boot or ftrace initialization, which can cause kernel warnings and potentially affect system reliability depending on kernel configuration (e.g., CONFIG_BUG_ON_DATA_CORRUPTION or panic-on-warn settings). There is no evidence of direct confidentiality or integrity impact; the vulnerability does not appear to enable privilege escalation or arbitrary code execution. The affected asset scope is limited to Linux kernel systems using ftrace with specific page size and entry size combinations (Feedly).

Apply the upstream Linux kernel patches that correct the pg_remaining calculation in ftrace_process_locs() and ftrace_allocate_records(). The fixes are available in the stable kernel tree at commits 9aef476717994e96dadfb359641c4b82b521aa36 and be55257fab181b93af38f8c4b1b3cb453a78d742. Users should update to a patched kernel version once their distribution (e.g., Red Hat, Ubuntu, SUSE) releases an updated package incorporating these fixes (Kernel Patch 1, Kernel Patch 2, Red Hat CVE).