CVE-2026-43258
Awaiting Analysis Awaiting Analysis - Queue
Memory Corruption in Linux Kernel During Compaction

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned tcache chunk"), and compiler internal errors. The failures disappear when compaction is disabled or when using global TLB invalidation. The root cause is insufficient TLB shootdown during page migration. Alpha relies on ASN-based MM context rollover for instruction cache coherency, but this alone is not sufficient to prevent stale data or instruction translations from surviving migration. Fix this by introducing a migration-specific helper that combines: - MM context invalidation (ASN rollover), - immediate per-CPU TLB invalidation (TBI), - synchronous cross-CPU shootdown when required. The helper is used only by migration/compaction paths to avoid changing global TLB semantics. Additionally, update flush_tlb_other(), pte_clear(), to use READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. This fixes observed crashes on both UP and SMP Alpha systems.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects Alpha systems running the Linux kernel when memory compaction is enabled. It causes sporadic user-space crashes and heap corruption due to insufficient Translation Lookaside Buffer (TLB) shootdown during page migration.

The root cause is that Alpha systems rely on ASN-based MM context rollover for instruction cache coherency, but this mechanism alone does not prevent stale data or instruction translations from persisting after page migration.

Symptoms include segmentation faults (SIGSEGV), failures in the glibc memory allocator (such as 'unaligned tcache chunk' errors), and compiler internal errors. These issues disappear if memory compaction is disabled or if global TLB invalidation is used.

The fix involves introducing a migration-specific helper that combines MM context invalidation, immediate per-CPU TLB invalidation, and synchronous cross-CPU shootdown to ensure proper memory and instruction cache coherency during page migration.


How can this vulnerability impact me? :

This vulnerability can cause sporadic crashes and heap corruption in user-space applications on Alpha systems running the Linux kernel with memory compaction enabled.

Such crashes may manifest as segmentation faults, memory allocator failures, or compiler errors, potentially leading to application instability, data loss, or unexpected behavior.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability manifests as sporadic user-space crashes and heap corruption on Alpha systems when memory compaction is enabled.

  • Look for symptoms such as SIGSEGV (segmentation faults), glibc allocator failures like "unaligned tcache chunk", and compiler internal errors.
  • Monitor system logs and application crash reports for these errors.

Since the issue is related to memory compaction and TLB shootdown on Alpha systems, detection involves observing these failure symptoms rather than specific network commands.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability immediately, disable memory compaction on affected Alpha systems.

Alternatively, use global TLB invalidation instead of relying on ASN-based MM context rollover.

Applying the kernel patch that introduces the migration-specific helper combining MM context invalidation, immediate per-CPU TLB invalidation, and synchronous cross-CPU shootdown will permanently fix the issue.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart