CVE-2026-46042

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()<br /> <br /> weighted_interleave_auto_store() fetches old_wi_state inside the if<br /> (!input) block only. This causes two memory leaks:<br /> <br /> 1. When a user writes "false" and the current mode is already manual,<br /> the function returns early without freeing the freshly allocated<br /> new_wi_state.<br /> <br /> 2. When a user writes "true", old_wi_state stays NULL because the<br /> fetch is skipped entirely. The old state is then overwritten by<br /> rcu_assign_pointer() but never freed, since the cleanup path is<br /> gated on old_wi_state being non-NULL. A user can trigger this<br /> repeatedly by writing "1" in a loop.<br /> <br /> Fix both leaks by moving the old_wi_state fetch before the input check,<br /> making it unconditional. This also allows a unified early return for both<br /> "true" and "false" when the requested mode matches the current mode.<br /> <br /> Reviewed by: Donet Tom