Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23052— ftrace: Do not over-allocate ftrace memory

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存分配计算错误，可能导致过度分配内存并触发警告。

AI Predicted 5.5 Difficulty: Easy EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux dc06779d338de4e5a46166a93ec124222e09f40a< bf802b936a7b269917e4dc233e49f6a928db8286 affected
2a6ce8bddd8aafa61aaa705e76eae810f22429be< 23936d19e4383c8dfb03931f032473d4baf92533 affected
4a3efc6baff931da9a85c6d2e42c87bd9a827399< 9aef476717994e96dadfb359641c4b82b521aa36 affected
4a3efc6baff931da9a85c6d2e42c87bd9a827399< be55257fab181b93af38f8c4b1b3cb453a78d742 affected
6.15 affected
< 6.15 unaffected
6.18.7≤ 6.18.* unaffected
6.19≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23052

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ftrace: Do not over-allocate ftrace memory
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not over-allocate ftrace memory The pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE (integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g. 4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages) have significantly more capacity than 256 * 170. This leads to pg_remaining being underestimated, which in turn makes skip (derived from skipped - pg_remaining) larger than expected, causing the WARN(skip != remaining) to trigger. Extra allocated pages for ftrace: 2 with 654 skipped WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0 A similar problem in ftrace_allocate_records() can result in allocating too many pages. This can trigger the second warning in ftrace_process_locs(). Extra allocated pages for ftrace WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580 Use the actual capacity of a page group to determine the number of pages to allocate. Have ftrace_allocate_pages() return the number of allocated pages to avoid having to calculate it. Use the actual page group capacity when validating the number of unused pages due to skipped entries. Drop the definition of ENTRIES_PER_PAGE since it is no longer used.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存分配计算错误，可能导致过度分配内存并触发警告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux dc06779d338de4e5a46166a93ec124222e09f40a ~ bf802b936a7b269917e4dc233e49f6a928db8286 -
Linux Linux 6.15 -

II. Public POCs for CVE-2026-23052

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23052

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23052 (2)

Same Patch Batch · Linux · 2026-02-04 · 79 CVEs total

CVE-2026-23098 8.8 HIGH netrom: fix double-free in nr_route_frame()
CVE-2026-23066 7.8 HIGH rxrpc: Fix recvmsg() unconditional requeue
CVE-2026-23074 7.8 HIGH net/sched: Enforce that teql can only be used as root qdisc
CVE-2026-23077 7.8 HIGH mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge
CVE-2026-23105 7.8 HIGH net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
CVE-2026-23103 7.8 HIGH ipvlan: Make the addrs_lock be per port
CVE-2026-23095 7.5 HIGH gue: Fix skb memleak with inner IP protocol 0.
CVE-2025-71192 7.0 HIGH ALSA: ac97: fix a double free in snd_ac97_controller_register()
CVE-2026-23064 net/sched: act_ife: avoid possible NULL deref
CVE-2026-23065 platform/x86/amd: Fix memory leak in wbrf_record()
CVE-2026-23067 iommu/io-pgtable-arm: fix size_t signedness bug in unmap path
CVE-2026-23042 idpf: fix aux device unplugging when rdma is not supported by vport
CVE-2026-23060 crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
CVE-2026-23059 scsi: qla2xxx: Sanitize payload size to prevent member overflow
CVE-2026-23058 can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
CVE-2026-23057 vsock/virtio: Coalesce only linear skb
CVE-2026-23056 uacce: implement mremap in uacce_vm_ops to return -EPERM
CVE-2025-71199 iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
CVE-2025-71198 iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
CVE-2026-23061 can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak

Showing top 20 of 79 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23052

No comments yet

Leave a comment