CVE-2026-46093

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel VMalloc Subsystem

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: take vmap_purge_lock in shrinker decay_va_pool_node() can be invoked concurrently from two paths: __purge_vmap_area_lazy() when pools are being purged, and the shrinker via vmap_node_shrink_scan(). However, decay_va_pool_node() is not safe to run concurrently, and the shrinker path currently lacks serialization, leading to races and possible leaks. Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker path to ensure serialization with purge users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46093

EUVD

EUVD-2026-32476

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 6.9 (inc) to 6.18.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's memory management subsystem, specifically in the vmalloc area. The function decay_va_pool_node() can be called concurrently from two different paths: one when memory pools are being purged (__purge_vmap_area_lazy()) and another via the shrinker mechanism (vmap_node_shrink_scan()).

The problem is that decay_va_pool_node() is not designed to be safe when run concurrently, and the shrinker path does not have proper serialization. This lack of synchronization can lead to race conditions and potentially cause memory leaks.

The fix involves protecting decay_va_pool_node() by acquiring the vmap_purge_lock in the shrinker path to ensure that these operations are serialized and do not run concurrently.

Impact Analysis

This vulnerability can lead to race conditions in the Linux kernel's memory management, which may cause memory leaks. Memory leaks can degrade system performance over time, potentially leading to resource exhaustion.

In critical systems, such leaks might cause instability or crashes, affecting system reliability and availability.

Mitigation Strategies

The vulnerability is resolved by ensuring that decay_va_pool_node() is protected by taking the vmap_purge_lock in the shrinker path to prevent concurrent execution and race conditions.

To mitigate this vulnerability immediately, update your Linux kernel to a version that includes this fix where vmap_purge_lock is taken in the shrinker path.

Hi! I’m here to help you understand CVE-2026-46093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70