PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46171 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's RISC-V KVM (Kernel-based Virtual Machine) subsystem, specifically within the vector context allocation routine. When `kvm_riscv_vcpu_alloc_vector_context` fails to allocate memory for `host_context.vector.datap` via the second `kzalloc` call, the previously allocated `guest_context.vector.datap` is not freed, resulting in a resource leak. This flaw affects kernel versions where RISC-V KVM vector support is present. The vulnerability was resolved by adding proper cleanup to free the first allocation before returning on failure.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux KVM virtualization on RISC-V hardware, cloud providers offering RISC-V instances, and kernel maintainers responsible for RISC-V architecture support

Technical summary

The function `kvm_riscv_vcpu_alloc_vector_context` in the Linux kernel's RISC-V KVM implementation performs two separate `kzalloc` allocations: one for `guest_context.vector.datap` and one for `host_context.vector.datap`. If the second allocation fails, the function returns an error code without freeing the first allocation, causing a memory leak. The fix adds proper error handling to free `guest_context.vector.datap` before returning when `host_context.vector.datap` allocation fails. This is a classic error-path resource leak pattern in kernel code.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable Linux kernel releases containing the referenced commits
  • Monitor vendor security advisories for distribution-specific kernel packages
  • Review systems running RISC-V KVM workloads for available memory pressure indicators
  • Consider enabling kernel memory leak detection (KASAN/KMEMLEAK) in test environments to identify similar issues

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-28. The fix is confirmed through three stable kernel Git commits referenced in the source data. No CVSS score or severity rating has been assigned as of the CVE's 'Awaiting Analysis' status.

Official resources

2026-05-28