CVE-2026-74576: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74576 is a Linux kernel vulnerability in the memory management subsystem (mm/slab) that allows unbounded recursion in the kernel memory free path, leading to a stack overflow and kernel crash. The flaw was introduced after commit 280ea9c3154b and affects Linux kernel versions starting from 6.10 up to (but not including) the patched releases. Fixed versions include 6.12.103, 6.18.44, 7.1.8, and 7.2-rc5. It was published on August 15, 2026, with an estimated CVSS severity of Medium (Github Advisory).

The root cause is a cyclic dependency between KMALLOC_NORMAL slab caches of different sizes when allocating obj_exts arrays used for allocation profiling and memcg accounting. For example, with sizeof(struct slabobj_ext) == 16: a kmalloc-512 slab (64 objects) requires a 1024-byte obj_exts array served from kmalloc-1k, while a kmalloc-1k slab (32 objects) requires a 512-byte array served from kmalloc-512 — each holding the other's obj_exts. When one slab is discarded, it triggers __free_slab() → free_slab_obj_exts() → kfree() → discard_slab() → __free_slab() in an unbounded cycle until the kernel stack is exhausted. The fix introduces a new KMALLOC_NO_OBJ_EXT kmalloc type whose caches are created with SLAB_NO_OBJ_EXT, preventing cycle formation by serving obj_exts arrays from a type that never itself has obj_exts arrays (Github Advisory). This was confirmed to have caused a real stack overflow on a production host in the Meta fleet, manifesting as BUG: TASK stack guard page was hit with ~125 recursive __free_slab ↔ kfree frames.

Successful exploitation results in a kernel stack overflow (BUG: TASK stack guard page was hit) and kernel crash, causing a complete denial of service of the affected system. A local user capable of triggering slab allocations through normal memory allocation operations — a low barrier on most Linux systems — can induce this condition. There is no evidence of confidentiality or integrity impact; the primary consequence is system unavailability (Github Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date (Github Advisory). The vulnerability requires local access to trigger slab allocations, limiting the attack surface to authenticated local users or processes. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. The EPSS score is not yet published.

• Logs/Kernel Messages: Kernel panic or oops messages containing BUG: TASK stack guard page was hit with RIP: 0010:kfree and a deep call trace showing repeated alternation of __free_slab and kfree (~125 or more frames).
• Process Behavior: Unexpected system freeze or reboot on hosts running Linux kernel 6.10–6.12.x (before 6.12.103), 6.18.x (before 6.18.44), or 7.1.x (before 7.1.8) with memory allocation profiling or memcg accounting enabled.
• System: Kernel crash dumps (vmcore) showing stack exhaustion in the mm/slab free path.

Update the Linux kernel to a patched version: 6.12.103 or later (for the 6.12 stable branch), 6.18.44 or later (for the 6.18 branch), 7.1.8 or later (for the 7.1 branch), or 7.2-rc5 and later. The corresponding stable kernel commits are 3e71bfbdd3fd, d01e88d421a6, ebefca49e4c6, and d9e6a7623938. As a short-term workaround, disabling memory allocation profiling (if configurable at runtime) may reduce exposure, but upgrading to a patched kernel is the recommended and definitive remediation (Github Advisory).

The vulnerability was reported by Danielle Costantino and Shakeel Butt based on a real production incident at Meta, where the bug caused a kernel stack overflow on a production host. The fix approach — introducing a new KMALLOC_NO_OBJ_EXT type rather than simply bumping allocation sizes — was shaped by feedback from kernel developer Vlastimil Babka, who noted that size-bumping would waste excessive memory for large kmalloc caches (Github Advisory). Community discussion was limited to kernel development channels, with no significant broader media coverage observed.