Ubuntu 24.04
6.8.0-79-generic

Based on my tests, it seems at least in this one scenario, the memory 
exhaustion appears to happen if/when the auditd userspace service
is installed and enabled. Apparmor had no bearing on the problem as it I had it 
disabled:


With Auditd ENABLED and apparmor DISABLED:
====================================
lab@leaktest:~$ sudo aa-status
apparmor module is loaded.
apparmor filesystem is not mounted.
lab@leaktest:~$ sudo s^C
lab@leaktest:~$ cat /proc/cmdline
BOOT_IMAGE=/vmlinuz-6.8.0-79-generic 
root=UUID=d36f7414-beb7-45e0-900e-9ab79cdbcb2d ro console=tty1 console=ttyS0 
apparmor=0


Auditd rate limiting noted in logs:
---
[Wed Sep  3 17:58:59 2025] audit: rate limit exceeded
[Wed Sep  3 17:59:00 2025] audit: audit_lost=289836 audit_rate_limit=100 
audit_backlog_limit=8192
[Wed Sep  3 17:59:00 2025] audit: rate limit exceeded
[Wed Sep  3 17:59:01 2025] audit: audit_lost=292814 audit_rate_limit=100 
audit_backlog_limit=8192
[Wed Sep  3 17:59:01 2025] audit: rate limit exceeded


Memory usage ballooned from ~ 500MB to 1.7GB (would continue to the host max 
6GB before OOM'ing), slabtop output:
---
 Active / Total Objects (% used)    : 1698488 / 1700387 (99.9%)
 Active / Total Slabs (% used)      : 93380 / 93380 (100.0%)
 Active / Total Caches (% used)     : 322 / 382 (84.3%)
 Active / Total Size (% used)       : 1599014.75K / 1600024.15K (99.9%)
 Minimum / Average / Maximum Object : 0.01K / 0.94K / 10.25K

  OBJS ACTIVE  USE OBJ SIZE  SLABS OBJ/SLAB CACHE SIZE NAME
676976 676976 100%    2.00K  42311       16   1353952K kmalloc-rnd-01-2k
677104 677104 100%    0.25K  42319       16    169276K skbuff_head_cache


With both Auditd DISABLED and apparmor DISABLED:
====================================
lab@leaktest:~$ sudo systemctl status auditd.service
○ auditd.service
     Loaded: masked (Reason: Unit auditd.service is masked.)
     Active: inactive (dead)
lab@leaktest:~$ cat /proc/cmdline
BOOT_IMAGE=/vmlinuz-6.8.0-79-generic 
root=UUID=d36f7414-beb7-45e0-900e-9ab79cdbcb2d ro console=tty1 console=ttyS0 
apparmor=0


Memory usage maintained at around 350-400M
slabtop:
---
 Active / Total Objects (% used)    : 347603 / 348988 (99.6%)
 Active / Total Slabs (% used)      : 8876 / 8876 (100.0%)
 Active / Total Caches (% used)     : 325 / 382 (85.1%)
 Active / Total Size (% used)       : 75899.81K / 76508.71K (99.2%)
 Minimum / Average / Maximum Object : 0.01K / 0.22K / 10.25K

  OBJS ACTIVE  USE OBJ SIZE  SLABS OBJ/SLAB CACHE SIZE NAME
 10650  10650 100%    0.62K    426       25      6816K inode_cache
 39648  39648 100%    0.14K   1416       28      5664K kernfs_node_cache
  4536   4536 100%    1.16K    168       27      5376K ext4_inode_cache

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2098730

Title:
  Kernel 6.8.0 memory leak

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2098730/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to