{"id":"CVE-2026-98920","revision":null,"records":[{"revision":"be67fa7f1cb84275b2219335cad0424b","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-98920","aliases":[],"title":"netfs: Fix missing alloc tagging of direct mempool allocations","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing alloc tagging of direct mempool allocations\n\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else. Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool's reserve and,\nif that runs empty, wait for elements to be returned. The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool's ->alloc() callback directly instead.\n\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current->alloc_tag having been set by the caller. With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to\n\n current->alloc_tag not set\n WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\n alloc_tag was not set\n WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\n\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount. The allocations are also missing from\n/proc/allocinfo.\n\nWrap the direct ->alloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc(). The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now.","state":0,"publishedAt":"2026-10-23T12:02:06.56+00:00","modifiedAt":"2026-10-23T12:05:25.919+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/netfs/objects.c\",\n \"fs/netfs/rolling_buffer.c\",\n \"include/linux/mempool.h\"\n ],\n \"versions\": [\n {\n \"version\": \"15ed8a9b7c63e9171f5139a6aaa1ffb61809861f\",\n \"lessThan\": \"5c03da745171485fd181f17b69213464f6d05f3d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1d78d56c43ef3768183e8370e7367b162700e049\",\n \"lessThan\": \"37a2042748bc880df03ff8315db86ed82991fbb8\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1d78d56c43ef3768183e8370e7367b162700e049\",\n \"lessThan\": \"b78b728e21c32ec4c330b299f657fb1eb02dffc2\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b343252d6f536203dd0660f676190dcbf6d2ecdc\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"3f6d7f8a5416d852648d15a05e895f1195ee8a85\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"6.12.114\",\n \"lessThan\": \"6.13\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.8\",\n \"lessThan\": \"7.2\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/netfs/objects.c\",\n \"fs/netfs/rolling_buffer.c\",\n \"include/linux/mempool.h\"\n ],\n \"versions\": [\n {\n \"version\": \"7.2\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"7.2\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.9\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d","https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8","https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98920","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98920","identifiers":["CVE-2026-98920"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-28T03:51:33.9437802+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-28T03:51:33.9437802+00:00","lastSuccessAt":"2026-10-28T03:51:34.0961236+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:34.0961246+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d2186f400c54d65f61687f78bb1a00d184d2e215877d0194d7ed70caee809a44-5e002664ec8433c1a0afdeba204aeae5ffbe828d6bbdb74ae37529eb2b6b1b6f","complete":true,"records":415510,"lastAttemptAt":"2026-10-28T03:51:32.842736+00:00","lastSuccessAt":"2026-10-28T03:51:32.8041674+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:32.842736+00:00","snapshotPublishedAt":"2026-10-28T03:24:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-233b167da0484950a642d70fecbb2f8f","complete":false,"records":9694,"lastAttemptAt":"2026-10-28T04:03:09.0504101+00:00","lastSuccessAt":"2026-10-28T04:03:09.046+00:00","error":"18 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-28T04:03:09.046+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4982,"expectedIdentifiers":13514,"failedIdentifiers":18},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-28T03:51:33.9437802+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-28T03:51:33.9437802+00:00","lastSuccessAt":"2026-10-28T03:51:34.0971299+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:34.09713+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8d16a738328646698f9217d8ea11893c","complete":true,"records":13449,"lastAttemptAt":"2026-10-28T03:51:36.4785313+00:00","lastSuccessAt":"2026-10-27T22:48:29.491+00:00","error":null,"lastVerifiedAt":"2026-10-27T22:48:29.491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13514,"expectedIdentifiers":13514,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f7cb12508d9e6a348c8a60f772ed85529cc80cd2ff853da1099b57754b20e943","complete":true,"records":9790,"lastAttemptAt":"2026-10-28T03:51:33.4681471+00:00","lastSuccessAt":"2026-10-27T21:49:03.9756799+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:33.4681471+00:00","snapshotPublishedAt":"2026-10-27T21:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-28T03:51:32.8879793+00:00","lastSuccessAt":"2026-10-27T21:46:38.0277323+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:32.8879793+00:00","snapshotPublishedAt":"2026-10-27T21:18:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-28T03:51:33.8464162+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:33.8464162+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5f3141cf1b985319fe2c9d9b1b1aab03f442c3a2272590c3c2e44d5d3d31bfb3","complete":true,"records":230854,"lastAttemptAt":"2026-10-28T03:51:33.3608683+00:00","lastSuccessAt":"2026-10-28T02:53:16.9493663+00:00","error":null,"lastVerifiedAt":"2026-10-28T03:51:33.3608683+00:00","snapshotPublishedAt":"2026-10-28T02:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}