VulnerabilityPublished 4 Feb 2026Updated 22 Aug 2026

CVE-2026-23052: Linux kernel · ftrace: Do not over-allocate ftrace memory

Affects Linux kernelSource GCVE Database

Not known to be exploited : upgrade to 6.17.0-1031.31 or 6.17.0-1030.30 when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 6.17.0-1031.31, 6.17.0-1030.30

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-qvpg-9fvc-x6cv

What to do

Upgrade Linux kernel to 6.17.0-1031.31 or 6.17.0-1030.30.

Affected software

Product	Affected	Fixed in
linux-hwe-edge	Affected <6.17.0-1030.30 <6.17.0-1031.31	Fixed in 6.17.0-1030.30 6.17.0-1031.31

AI-suggested

Official patches are available and have been released by Ubuntu for affected Linux kernel versions. Users should apply the updates promptly and reboot their systems to ensure the fixes take effect. Due to an ABI change in the kernel updates, recompilation and reinstallation of all third-party kernel modules are required. Follow the vendor's update instructions carefully to fully remediate the vulnerability.

Description

A vulnerability in the Linux kernel's ftrace subsystem involving incorrect memory allocation calculations has been resolved. The issue arises because the calculation of remaining pages underestimates available capacity when PAGE_SIZE is not a multiple of ENTRY_SIZE, leading to over-allocation of ftrace memory and triggering kernel warnings. This flaw could potentially be exploited to compromise the system. The vulnerability affects multiple Linux kernel versions prior to 6.17.0-1021.21~24.04.1 and related builds. Official patches are available from Ubuntu, and users are advised to update and reboot to apply fixes. Due to an ABI change, recompilation of third-party kernel modules may be necessary after updating. The severity is assessed as medium based on the impact described.

Impact

The vulnerability can cause the Linux kernel to allocate more memory than intended in the ftrace subsystem, potentially leading to kernel warnings and instability. While the advisory notes that an attacker could possibly use these issues to compromise the system, no known exploits are reported in the wild. The impact is considered medium severity, reflecting the potential for system compromise but no confirmed active exploitation.

Summary

The Linux kernel vulnerability CVE-2026-23052 involves the ftrace subsystem's memory allocation logic. Specifically, the pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group. However, because ENTRIES_PER_PAGE is computed via integer division (PAGE_SIZE / ENTRY_SIZE), when PAGE_SIZE is not a multiple of ENTRY_SIZE, the actual capacity is larger than assumed. This causes pg_remaining to be underestimated, resulting in excessive memory allocation and kernel warnings. A similar issue in ftrace_allocate_records() can also cause over-allocation. These flaws have been fixed in Linux kernel versions 6.17.0 and later. Ubuntu has released security updates addressing this and other kernel vulnerabilities, requiring system updates and reboots. The update also requires recompilation of third-party kernel modules due to ABI changes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 22 Aug 2026, 21:33 UTC

Technical details

References

Community reviews

Related threats