PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46063 Linux CVE debrief

A deadlock vulnerability exists in the Linux kernel's x86 shadow stack (shstk) signal return handling. When processing sigreturn, the kernel reads the shadow stack signal frame while holding the mmap read lock to verify the memory is actually shadow stack memory. If this read triggers a page fault, the fault handler attempts to acquire another mmap read lock. Under contention with a writer waiting on another CPU, this second read lock acquisition can fail and cause a deadlock. The fix removes the mmap lock during userspace access and instead uses mmap_lock_speculate_*() helpers to detect VMA changes between lock drop and access, retrying if necessary. This approach requires PER_VMA_LOCK, which is now made a dependency for X86_USER_SHADOW_STACK. Support for non-SMP configurations is dropped as the !SMP shadow stack user base is assumed non-existent.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux kernel maintainers, distribution security teams, organizations running x86_64 Linux with Intel CET shadow stack enabled, cloud providers offering confidential computing with memory integrity features, and security-conscious enterprises using control-flow protection mechanisms.

Technical summary

The vulnerability occurs in arch/x86/kernel/shstk.c during signal return processing. The original code held mmap_read_lock() while accessing userspace shadow stack memory to validate VMA flags. This created a reentrancy hazard: copy_from_user() could page fault, and handle_mm_fault() would recursively attempt mmap_read_lock(). With a concurrent writer pending, the second reader would block, creating deadlock with the writer waiting for the first reader to release. The fix introduces speculative lockless access using mm_lock_seq sequence counters (available via PER_VMA_LOCK) to detect concurrent modifications without holding the lock across the copy. The patchset also removes an optimization that skipped validation when SSP was assumed on shadow stack, making security-critical code paths more uniform and testable.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches once available for your distribution
  • Verify kernel configuration includes CONFIG_PER_VMA_LOCK=y for shadow stack support
  • Monitor distribution security advisories for backported fixes
  • Review systems using Control-Flow Enforcement Technology (CET) with shadow stacks
  • Consider disabling shadow stack features temporarily on critical systems if patches unavailable and threat model warrants
  • Audit for any observed system hangs or deadlocks during signal-heavy workloads as potential exploitation indicators

Evidence notes

CVE published 2026-05-27. Kernel commit references indicate fixes applied to stable branches. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46063 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46063

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46063 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46063

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3d29db827502067626062f5c74dd502d14ab15bc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4f3374c990fb2adec06d20fd6d780927811c9aa0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9874b2917b9fbc30956fee209d3c4aa47201c64e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d042d69b417515959e49021fef008c9b04a99bd5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e2c2b044458cbf22da05264fa707308e8d4f86f9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.