CVE-2026-74576

CVE-2026-74576 is a stack overflow in the Linux kernel's slab allocator caused by a recursion hazard in the obj_exts profiling mechanism. The kernel's memory profiling infrastructure allocates metadata about each allocation (obj_exts arrays) through the same kmalloc caches it is instrumenting. When the profiler requests metadata for allocations that themselves serve obj_exts storage, a cycle forms: obj_exts for kmalloc-512 may be allocated from kmalloc-1k, whose obj_exts may come from kmalloc-512, creating infinite recursion under specific slab geometries. Meta's production systems triggered this via particular allocation patterns that most deployments would never hit. The fix introduces KMALLOC_NO_OBJ_EXT, a dedicated allocation type that opts obj_exts storage out of recursive instrumentation. This is architecturally correct but note what it actually does: it creates a deferred initialization window during boot where the system either falls back to the vulnerable KMALLOC_NORMAL path or operates without obj_exts entirely. The old unsafe path doesn't disappear—it becomes conditional, gated on profiling state and boot sequence completion. This temporal dimension is the critical insight: the vulnerability is no longer purely geometry-dependent; it now also depends on initialization order, making it harder to reason about. Check your kernels: if you run memory profiling, verify that obj_exts allocations are being served from KMALLOC_NO_OBJ_EXT caches (check /proc/slabinfo or kmalloc-*.kmalloc-2048.type in recent kernels). More importantly, audit any other profiling, accounting, or telemetry subsystems where the instrumentation infrastructure allocates its own metadata through the same mechanism it monitors. This is the third recognized instance of this pattern in kernel history—lockdep and ftrace had similar self-referential hazards—and each fix adds a new allocation category that future developers must reason about. The pattern will recur in other subsystems. Treat KMALLOC_NO_OBJ_EXT as the canary: any new telemetry infrastructure that requires its own allocation pool is signaling the same architectural blind spot.

Reviewed through automated stages and approved by a human before publication.