CVE-2026-74576

A flaw was found in the Linux kernel's slab memory management, which Red Hat rates as Moderate severity. When slab object extension (obj_exts) arrays, used for memory allocation profiling and memcg accounting, are allocated from kmalloc caches that hold each other's arrays in a cycle (for example a kmalloc-512 slab and a kmalloc-1k slab each holding the other's obj_exts array), discarding one slab recursively frees the other's array through __free_slab(), kfree(), and discard_slab() until the kernel task stack is exhausted. A local unprivileged user able to drive the affected allocation and free patterns could use this to cause a stack overflow and kernel panic, resulting in a denial of service of the entire system. The kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 is affected; the fix is currently deferred because the upstream solution requires substantial restructuring of kmalloc type handling (introducing a new KMALLOC_NO_OBJ_EXT kmalloc type), so the residual risk until a fix is delivered is a local denial of service. The Red Hat Enterprise Linux 6, 7, 8, and 9 kernels and kernel-rt are marked not affected because the vulnerable code is not present in those streams. Red Hat assesses this flaw as Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5), lower than the upstream CVE.org rating of Important (7.5), because exploitation requires local access and depends on specific slab geometry, kernel configuration, and workload timing rather than a network attack vector, and the impact is limited to availability.