Linux Kernel Page Pool Vulnerability: Default GFP_NOWARN for Atomic Allocations

Vulnerability

A vulnerability in the Linux kernel's page pool management has been addressed. Driver authors frequently neglect to include GFP_NOWARN for page allocations made during the data path, particularly in atomic contexts. This oversight can lead to unnecessary out-of-memory (OOM) errors for users, especially during network receive operations, where page allocation failures are expected under OOM conditions. The kernel now ensures that GFP_NOWARN is automatically applied to atomic allocations in the page pool, mitigating these issues.

Impact

This change reduces the likelihood of page allocation failures during critical network operations, particularly under low memory conditions, which can disrupt data processing and application performance.

Reproduction

The vulnerability can be reproduced by creating a network driver that allocates pages without using the GFP_NOWARN flag, particularly during atomic operations. This can lead to page allocation failures when the system is low on memory, causing OOM errors that disrupt normal operation.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.

Added: Dec 16, 2025, 6:00 PM
Updated: Dec 16, 2025, 6:00 PM

Vulnerability Rating

Custom Algorithm
spread
9.0
impact
0.6
exploitability
5.7
remediation
7.7
relevance
1.6
threat
4.8
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.