CVE-2026-43285
Race Condition in Linux Kernel Memory Management
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19.0-rc5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves improper access to the current->mems_allowed_seq variable when the allow_spin flag is not set. The issue arises because current->mems_allowed_seq is a seqcount_spinlock_t, which is not safe to use in Non-Maskable Interrupt (NMI) contexts.
When the function get_from_any_partial() is called in an NMI context, it leads to inconsistent lock states and potential deadlocks due to unsafe locking scenarios. Specifically, the kernel may attempt to acquire a lock that is already held, causing a deadlock.
The root cause is that seqcount_t is not NMI-safe, and the correct type to use in such interruptible contexts is seqcount_latch_t. The fix avoids accessing current->mems_allowed_seq and prevents retries when allow_spin is false, thereby preventing deadlocks.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to enter a deadlock state when handling certain interrupts, specifically Non-Maskable Interrupts (NMIs).
Such deadlocks can lead to system instability, freezes, or crashes, potentially causing denial of service or requiring a system reboot to recover.
Systems relying on the affected kernel versions may experience degraded reliability and availability due to this issue.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as lockdep warnings related to inconsistent lock states when get_from_any_partial() is called in an NMI context. Detection involves monitoring kernel logs for warnings about inconsistent lock states and deadlocks involving seqcount_spinlock_t.
You can check your kernel logs for messages similar to the following warning:
- WARNING: inconsistent lock state
- inconsistent {INITIAL USE} -> {IN-NMI} usage
To detect this on your system, you can use the following commands:
- dmesg | grep -i 'inconsistent lock state'
- journalctl -k | grep -i 'inconsistent lock state'
- grep -i 'lockdep' /var/log/kern.log
These commands help identify kernel warnings related to this vulnerability by searching for lockdep or inconsistent lock state messages in kernel logs.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by accessing current->mems_allowed_seq, which is not NMI-safe, in contexts where it can lead to deadlocks.
Immediate mitigation steps include:
- Avoid accessing current->mems_allowed_seq in NMI (Non-Maskable Interrupt) contexts.
- Modify or update kernel code to use seqcount_latch_t instead of seqcount_t when the read path can interrupt the write-side critical section, as seqcount_latch_t is NMI-safe.
- Apply the patch or update to the Linux kernel version where this issue is resolved.
Since this is a kernel-level issue, the most effective immediate step is to update the Linux kernel to a version that includes the fix for this vulnerability.