CVE-2026-23219

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: Add alloctaggingslabfreehook for memcgallocabort_single

When CONFIGMEMALLOCPROFILINGDEBUG is enabled, the following warning may be noticed:

[ 3959.023862] ------------[ cut here ]------------ [ 3959.023891] alloctag was not cleared (got tag for lib/xarray.c:378) [ 3959.023947] WARNING: ./include/linux/alloctag.h:155 at alloctagadd+0x128/0x178, CPU#6: mkfs.ntfs/113998 [ 3959.023978] Modules linked in: dnsresolver tun brd overlay exfat btrfs blake2b libblake2b xor xorneon raid6pq loop sctp ip6udptunnel udptunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink srmod virtiogpu cdrom drmclientlib virtiodmabuf drmshmemhelper drmkmshelper ghashce drm sm4 backlight virtionet netfailover virtioscsi failover virtioconsole virtioblk virtiommio dmmirror dmregionhash dmlog dmmultipath dmmod i2cdev aesneonbs aesceblk [last unloaded: hwpoisoninject] [ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary) [ 3959.024182] Tainted: [W]=WARN [ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3959.024199] pc : alloctagadd+0x128/0x178 [ 3959.024207] lr : alloctagadd+0x128/0x178 [ 3959.024214] sp : ffff80008b696d60 [ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240 [ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860 [ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0 [ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000 [ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293 [ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000 [ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001 [ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838 [ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640 [ 3959.024340] Call trace: [ 3959.024346] alloctag_add+0x128/0x178 (P) [ 3959.024355] __alloctaggingslaballochook+0x11c/0x1a8 [ 3959.024362] kmemcachealloclrunoprof+0x1b8/0x5e8 [ 3959.024369] xasalloc+0x304/0x4f0 [ 3959.024381] xascreate+0x1e0/0x4a0 [ 3959.024388] xas_store+0x68/0xda8 [ 3959.024395] __filemapaddfolio+0x5b0/0xbd8 [ 3959.024409] filemapaddfolio+0x16c/0x7e0 [ 3959.024416] __filemapgetfolio_mpol+0x2dc/0x9e8 [ 3959.024424] iomapgetfolio+0xfc/0x180 [ 3959.024435] __iomapgetfolio+0x2f8/0x4b8 [ 3959.024441] iomap_writebegin+0x198/0xc18 [ 3959.024448] iomapwriteiter+0x2ec/0x8f8 [ 3959.024454] iomapfilebufferedwrite+0x19c/0x290 [ 3959.024461] blkdevwriteiter+0x38c/0x978 [ 3959.024470] vfswrite+0x4d4/0x928 [ 3959.024482] ksyswrite+0xfc/0x1f8 [ 3959.024489] _arm64syswrite+0x74/0xb0 [ 3959.024496] invokesyscall+0xd4/0x258 [ 3959.024507] el0svccommon.constprop.0+0xb4/0x240 [ 3959.024514] doel0svc+0x48/0x68 [ 3959.024520] el0svc+0x40/0xf8 [ 3959.024526] el0t64synchandler+0xa0/0xe8 [ 3959.024533] el0t64sync+0x1ac/0x1b0 [ 3959.024540] ---[ end trace 0000000000000000 ]---

When __memcgslabpostallochook() fails, there are two different free paths depending on whether size == 1 or size != 1. In the kmemcachefreebulk() path, we do call alloctaggingslabfreehook(). However, in memcgallocabortsingle() we don't, the above warning will be triggered on the next allocation.

Therefore, add alloctaggingslabfreehook() to the memcgallocabort_single() path.