CVE-2026-74576

A flaw was found in the Linux kernel's memory management. This vulnerability allows for unbounded recursion in the slab free path, a process where the kernel manages and releases small blocks of memory. When certain kernel memory allocation caches (kmalloc caches) form a cycle during internal data structure allocation, it can trigger a recursive freeing process. This unbounded recursion can lead to a stack overflow, causing the system to crash and resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's slab memory management, which Red Hat rates as Moderate severity. When slab object extension (obj_exts) arrays, used for memory allocation profiling and memcg accounting, are allocated from kmalloc caches that hold each other's arrays in a cycle (for example a kmalloc-512 slab and a kmalloc-1k slab each holding the other's obj_exts array), discarding one slab recursively frees the other's array through __free_slab(), kfree(), and discard_slab() until the kernel task stack is exhausted. A local unprivileged user able to drive the affected allocation and free patterns could use this to cause a stack overflow and kernel panic, resulting in a denial of service of the entire system. The kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 is affected; the fix is currently deferred because the upstream solution requires substantial restructuring of kmalloc type handling (introducing a new KMALLOC_NO_OBJ_EXT kmalloc type), so the residual risk until a fix is delivered is a local denial of service. The Red Hat Enterprise Linux 6, 7, 8, and 9 kernels and kernel-rt are marked not affected because the vulnerable code is not present in those streams. Red Hat assesses this flaw as Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5), lower than the upstream CVE.org rating of Important (7.5), because exploitation requires local access and depends on specific slab geometry, kernel configuration, and workload timing rather than a network attack vector, and the impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.