mod-php: preg_match(): Allocation of JIT memory failed - caused by systemd MemoryDenyWriteExecute

[RichardNeill]

Description

This isn't a PHP bug, but a bug caused by the interoperation of PHP 8.5 and Apache mod-php (NOT fpm),
when systemd is set to be more restrictive.

This occurs in Ubuntu 26.04 ("Resolute Raccoon") - i.e. it's going to be a default problem for a lot of people quite soon. I'm filing it here, so that others can find it (as it took me hours to figure out).

1. The error message is:

Warning: preg_match(): Allocation of JIT memory failed, PCRE JIT will be disabled. This is likely caused by security restrictions. Either grant PHP permission to allocate executable memory, or set pcre.jit=0 in [MY PHP FILENAME]

2. Root cause: the way JIT works is to write to memory, then compile the Regex, then make that memory executable. This falls foul of one of the stricter protections added to systemd, namely:
   MemoryDenyWriteExecute

3. To fix the problem, do sudo systemctl edit apache2 and add the lines

[Service]
MemoryDenyWriteExecute=no

then save and restart apache.

4. ALTERNATIVELY, switch from mod-php to php-fpm.

5. See also: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/2144455

6. May I request a comment on whether the right thing to do is to disable PHP's JIT, or whether it is in fact safe to remove that recently added systemd restriction. Thanks.

PHP Version

PHP 8.5.2 (cli) (built: Jan 21 2026 17:35:28) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.5.2, Copyright (c) Zend Technologies
    with Xdebug v3.5.0, Copyright (c) 2002-2025, by Derick Rethans
    with Zend OPcache v8.5.2, Copyright (c), by Zend Technologies

Using libapache2-mod-php8.5 .

Operating System

Ubuntu 26.04

[devnexen]

Hi @RichardNeill

4. ALTERNATIVELY, switch from mod-php to php-fpm.
5. See also: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/2144455
6. May I request a comment on whether the right thing to do is to disable PHP's JIT, or whether it is in fact safe to remove that recently added systemd restriction. Thanks.

If you re looking to the safest solution, it is definitively to let this setting on and disabling PCRE's JIT IMHO. That said, if switching from mod-php to php-fpm isn't too much of a hassle for your setup, that's the better long-term fix — you get to keep PCRE JIT enabled while Apache retains its hardened systemd profile.