# CVE-2026-98920: linux: In the Linux kernel, the following vulnerability has been resolved:  netfs: Fix missing alloc tagging of direct mempo...

CVE-2026-98920 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98920 (version 7.2.9-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98920
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 23, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  netfs: Fix missing alloc tagging of direct mempool allocations  Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else.  Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned.  The GFP_KERNEL paths, which can return -ENOMEM to their callers, invoke the pool's ->alloc() callback directly instead.  The direct call, however, skips the alloc_hooks() wrapper that the mempool_alloc() macro provides.  The pool callbacks, mempool_alloc_slab() and mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof() and rely on current->alloc_tag having been set by the caller.  With CONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to      current->alloc_tag not set     WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook     alloc_tag was not set     WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook  at allocation and free time respectively, as reported when reading files on a CIFS mount.  The allocations are also missing from /proc/allocinfo.  Wrap the direct ->alloc() invocations in alloc_hooks() with a new mempool_alloc_noreserve() helper in include/linux/mempool.h, next to the other alloc_hooks()-wrapped macros such as mempool_alloc().  The GFP_KERNEL paths keep their failable allocation semantics, they just get tagged now.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.9-1 | [DEBIAN-CVE-2026-98920](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98920.md) | Oct 24, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.