CVE-2026-23052 (GCVE-0-2026-23052)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:04 – Updated: 2026-02-09 08:37
VLAI?
Title
ftrace: Do not over-allocate ftrace memory
Summary
In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not over-allocate ftrace memory The pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE (integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g. 4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages) have significantly more capacity than 256 * 170. This leads to pg_remaining being underestimated, which in turn makes skip (derived from skipped - pg_remaining) larger than expected, causing the WARN(skip != remaining) to trigger. Extra allocated pages for ftrace: 2 with 654 skipped WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0 A similar problem in ftrace_allocate_records() can result in allocating too many pages. This can trigger the second warning in ftrace_process_locs(). Extra allocated pages for ftrace WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580 Use the actual capacity of a page group to determine the number of pages to allocate. Have ftrace_allocate_pages() return the number of allocated pages to avoid having to calculate it. Use the actual page group capacity when validating the number of unused pages due to skipped entries. Drop the definition of ENTRIES_PER_PAGE since it is no longer used.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4a3efc6baff931da9a85c6d2e42c87bd9a827399 , < 9aef476717994e96dadfb359641c4b82b521aa36 (git)
Affected: 4a3efc6baff931da9a85c6d2e42c87bd9a827399 , < be55257fab181b93af38f8c4b1b3cb453a78d742 (git)
Create a notification for this product.
    Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.7 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9aef476717994e96dadfb359641c4b82b521aa36",
              "status": "affected",
              "version": "4a3efc6baff931da9a85c6d2e42c87bd9a827399",
              "versionType": "git"
            },
            {
              "lessThan": "be55257fab181b93af38f8c4b1b3cb453a78d742",
              "status": "affected",
              "version": "4a3efc6baff931da9a85c6d2e42c87bd9a827399",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Do not over-allocate ftrace memory\n\nThe pg_remaining calculation in ftrace_process_locs() assumes that\nENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the\nallocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE\n(integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g.\n4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages)\nhave significantly more capacity than 256 * 170. This leads to pg_remaining\nbeing underestimated, which in turn makes skip (derived from skipped -\npg_remaining) larger than expected, causing the WARN(skip != remaining)\nto trigger.\n\nExtra allocated pages for ftrace: 2 with 654 skipped\nWARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0\n\nA similar problem in ftrace_allocate_records() can result in allocating\ntoo many pages. This can trigger the second warning in\nftrace_process_locs().\n\nExtra allocated pages for ftrace\nWARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580\n\nUse the actual capacity of a page group to determine the number of pages\nto allocate. Have ftrace_allocate_pages() return the number of allocated\npages to avoid having to calculate it. Use the actual page group capacity\nwhen validating the number of unused pages due to skipped entries.\nDrop the definition of ENTRIES_PER_PAGE since it is no longer used."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T08:37:49.966Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9aef476717994e96dadfb359641c4b82b521aa36"
        },
        {
          "url": "https://git.kernel.org/stable/c/be55257fab181b93af38f8c4b1b3cb453a78d742"
        }
      ],
      "title": "ftrace: Do not over-allocate ftrace memory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23052",
    "datePublished": "2026-02-04T16:04:21.739Z",
    "dateReserved": "2026-01-13T15:37:45.950Z",
    "dateUpdated": "2026-02-09T08:37:49.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23052\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T17:16:15.867\",\"lastModified\":\"2026-02-05T14:57:20.563\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nftrace: Do not over-allocate ftrace memory\\n\\nThe pg_remaining calculation in ftrace_process_locs() assumes that\\nENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the\\nallocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE\\n(integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g.\\n4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages)\\nhave significantly more capacity than 256 * 170. This leads to pg_remaining\\nbeing underestimated, which in turn makes skip (derived from skipped -\\npg_remaining) larger than expected, causing the WARN(skip != remaining)\\nto trigger.\\n\\nExtra allocated pages for ftrace: 2 with 654 skipped\\nWARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0\\n\\nA similar problem in ftrace_allocate_records() can result in allocating\\ntoo many pages. This can trigger the second warning in\\nftrace_process_locs().\\n\\nExtra allocated pages for ftrace\\nWARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580\\n\\nUse the actual capacity of a page group to determine the number of pages\\nto allocate. Have ftrace_allocate_pages() return the number of allocated\\npages to avoid having to calculate it. Use the actual page group capacity\\nwhen validating the number of unused pages due to skipped entries.\\nDrop the definition of ENTRIES_PER_PAGE since it is no longer used.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9aef476717994e96dadfb359641c4b82b521aa36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be55257fab181b93af38f8c4b1b3cb453a78d742\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.