PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46093 Linux CVE debrief

A race condition in the Linux kernel's vmalloc subsystem could lead to memory leaks when the shrinker path and purge path execute concurrently. The vulnerability exists because decay_va_pool_node() lacks proper serialization when invoked from vmap_node_shrink_scan() via the shrinker, while __purge_vmap_area_lazy() already holds vmap_purge_lock. The fix adds vmap_purge_lock acquisition in the shrinker path to ensure mutual exclusion with purge operations. This is a local-only issue affecting kernel memory management; exploitation requires ability to trigger memory pressure conditions that activate the shrinker. No CVSS score has been assigned by NVD as of publication.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, kernel maintainers, and security teams managing systems where untrusted users may create memory pressure conditions

Technical summary

The Linux kernel's vmalloc subsystem contains a race condition where decay_va_pool_node() can be called concurrently from two paths: __purge_vmap_area_lazy() (which holds vmap_purge_lock) and vmap_node_shrink_scan() (the shrinker path, which did not). This concurrent execution without proper locking could lead to races and memory leaks. The resolution adds vmap_purge_lock acquisition in the shrinker path to ensure serialization with purge users. The vulnerability is local-only and requires conditions that trigger shrinker activation.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor vendor security advisories for kernel updates addressing this vmalloc race condition
  • Prioritize patching systems under memory pressure or with untrusted local users
  • Review system logs for unusual vmalloc-related warnings that may indicate trigger attempts

Evidence notes

CVE description confirms concurrent invocation paths and missing serialization. Kernel git commits (ref-4, ref-5, ref-6) provide patch implementation. NVD status shows 'Awaiting Analysis' with no CVSS assigned.

Official resources

2026-05-27