How Linux fork() Uses Copy-on-Write and Why It Can Exhaust Memory

When a Linux process calls fork(), the kernel does not immediately duplicate physical memory; instead, it copies the page table hierarchy and marks all entries as read-only. Any subsequent write by either the parent or child process triggers a hardware page fault, prompting the kernel to allocate a new physical page and copy the data. This Copy-on-Write mechanism keeps fork() fast under low-write conditions but becomes costly when workloads involve heavy, sustained writes to large memory regions. Systems running in-memory databases like Redis can experience write amplification, TLB thrashing, and uncontrolled memory growth during background snapshot operations. In extreme cases, the cascade of micro-allocations exhausts available RAM and activates the kernel's Out-of-Memory killer, terminating processes unexpectedly.