Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk5 min

What Actually Happens Between malloc() and Physical RAM: Virtual Memory, Page Faults, and the MMU

On Linux with glibc, malloc() returns a virtual address—not a physical RAM address. Learn how mappings, the MMU, demand paging, and page faults connect an allocation to memory.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

malloc() does not hand your program a physical RAM address. On Linux with glibc, it returns a virtual address; the allocator may reuse existing space or request more from the kernel, and physical memory may be assigned only when your program accesses a page. The kernel manages the mappings, while the processor’s memory management unit (MMU) translates addresses and raises a page-fault exception when an access needs attention.

What actually happens when I call malloc()?

The C library’s malloc(size) function requests storage for size bytes and returns a pointer to uninitialized storage, or indicates failure. The pointer is an address in the process’s virtual address space, not a physical RAM address. The C interface does not prescribe whether an implementation gets that space using brk(), mmap(), or another mechanism. Linux man-pages: malloc(3)

As an Amazon Associate I earn from qualifying purchases.

glibc first manages the request

The allocator may satisfy a request from a free block it already manages. If it needs additional address space, Linux/glibc commonly expands the process heap with brk() or obtains a private anonymous mapping with mmap(), particularly for large requests.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Linux man-pages 6.19, in its malloc(3) page dated 2026-02-08, documents a default glibc MMAP_THRESHOLD of 128 kB for using mmap() for large allocations. This is an adjustable implementation default, not a universal cutoff: tunables, allocator state, arenas, and versions can affect the route a request takes. It should not be generalized to other C libraries, operating systems, or configurations. Linux man-pages: malloc(3)

The kernel establishes address-space mappings

When glibc requests an mmap() region, Linux records a mapping in the process’s virtual address space. That reserves an address range with defined mapping and access rules; it does not necessarily mean every page in the range already has a resident physical frame. Linux supports demand paging, in which memory is supplied as needed. The MAP_POPULATE flag can request prefaulting page tables and read-ahead for file mappings, but the mapping can still succeed if the full range could not be populated. Linux man-pages: mmap(2)

Does malloc() allocate physical memory?

Not necessarily—not all of it, and not necessarily at the moment the function returns. A successful allocation gives the program an address range it can use, subject to the system’s memory policy and the allocator’s behavior. The kernel can defer establishing resident physical backing until an access requires it.

Linux man-pages puts the risk plainly: “By default, Linux follows an optimistic memory allocation strategy.” In other words, a non-NULL pointer is not a guarantee that every requested byte is already resident or that the system will ultimately be able to provide all the memory if it is needed. Memory pressure and system policy can matter later. Linux man-pages: malloc(3)

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why does a memory profiler show less RAM than I allocated?

An allocation is a request for usable virtual address space, while resident memory measures pages currently present in physical memory. If your program has allocated a large range but accessed only a small part of it, some pages may not yet be resident. A profiler reporting resident memory can therefore show less RAM in use than the total number of bytes requested through malloc().

The exact gap depends on what the profiler measures and when it samples. Virtual size, resident set size, allocator bookkeeping, shared mappings, and other process memory categories are different measurements; do not treat any one profiler number as a direct count of bytes requested by malloc(). Demand paging explains one common reason for the difference, but the label and definition used by the particular tool matter.

What happens when I touch a page for the first time?

  1. Your code accesses the pointer. A load or store uses the virtual address returned by the allocator.
  2. The MMU checks the translation. The processor’s MMU uses page-table structures to translate virtual addresses to physical addresses. Hardware translation caches, commonly called TLBs, can speed up repeated translations. The operating system establishes and maintains the mappings; the MMU does not decide how malloc() obtains storage. Page-table depth and implementation details vary across architectures. Linux kernel documentation 6.10: Page Tables
  3. A missing or invalid translation can cause a page fault. The processor raises a page-fault exception, transferring control to the kernel. The kernel checks whether the address and requested operation are valid, then resolves the access if it can.
  4. The kernel supplies or locates backing as needed. For anonymous memory, it may establish backing with an available, zeroed page. For file-backed mappings, it may need to load file contents; for swapped-out memory, it may need to bring the page back from storage. If the address is invalid or the operation is prohibited, the process may instead receive a signal such as SIGSEGV. Linux kernel documentation 6.10: Page Tables GNU C Library manual: Memory-mapped I/O
  5. The access can proceed if handling succeeds. With the mapping established, the processor can complete the instruction against the relevant physical page frame.

Does every page fault mean disk access?

No. A page fault is an exception that asks the kernel to resolve or reject an access; it does not by definition mean a disk read. For example, a first access to valid anonymous memory can be handled by establishing an anonymous page without reading file data from disk. A fault involving file-backed data that is not resident, or a page that has been swapped out, may require the kernel to fetch content from storage. The work depends on the mapping and the page’s current state. Linux kernel documentation 6.10: Page Tables GNU C Library manual: Memory-mapped I/O

Once a page is resident, later accesses often use an existing translation rather than faulting again. Pages can also be shared, reclaimed, or remapped, so a virtual address does not promise a unique physical location that remains permanently reserved. The details of mapping interfaces and flags can vary between Linux and other systems; POSIX describes the broader interface, while Linux-specific behavior is documented in its mmap(2) page. Linux man-pages: mmap(2) POSIX Programmer’s Manual: mmap(3p)

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

A useful mental model

Think of the process as using addresses in its own numbered map. The allocator finds or requests usable regions in that map; the kernel maintains the rules that connect virtual pages to backing; and the MMU consults the mapping machinery to translate an address when the CPU accesses it. If a valid entry is not ready, a page fault gives the kernel a chance to establish or validate it. This is only an analogy: real page tables, TLBs, permissions, shared mappings, and backing policies add important detail.

These allocation-path specifics describe Linux with glibc, not every C implementation. The page-table discussion draws on the Linux kernel’s version 6.10 overview and is not a specification of every processor’s page-table format. For a broader treatment of address spaces, paging, and page tables, see Operating Systems: Three Easy Pieces, which includes free online chapters.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.