PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46171 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's RISC-V KVM (Kernel-based Virtual Machine) subsystem, specifically within the vector context allocation routine. When `kvm_riscv_vcpu_alloc_vector_context` fails to allocate memory for `host_context.vector.datap` via the second `kzalloc` call, the previously allocated `guest_context.vector.datap` is not freed, resulting in a resource leak. This flaw affects kernel versions where RISC-V KVM vector support is present. The vulnerability was resolved by adding proper cleanup to free the first allocation before returning on failure.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-11
Advisory published
2026-05-28
Advisory updated
2026-06-11

Who should care

Organizations running Linux KVM virtualization on RISC-V hardware, cloud providers offering RISC-V instances, and kernel maintainers responsible for RISC-V architecture support

Technical summary

The function `kvm_riscv_vcpu_alloc_vector_context` in the Linux kernel's RISC-V KVM implementation performs two separate `kzalloc` allocations: one for `guest_context.vector.datap` and one for `host_context.vector.datap`. If the second allocation fails, the function returns an error code without freeing the first allocation, causing a memory leak. The fix adds proper error handling to free `guest_context.vector.datap` before returning when `host_context.vector.datap` allocation fails. This is a classic error-path resource leak pattern in kernel code.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable Linux kernel releases containing the referenced commits
  • Monitor vendor security advisories for distribution-specific kernel packages
  • Review systems running RISC-V KVM workloads for available memory pressure indicators
  • Consider enabling kernel memory leak detection (KASAN/KMEMLEAK) in test environments to identify similar issues

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-28. The fix is confirmed through three stable kernel Git commits referenced in the source data. No CVSS score or severity rating has been assigned as of the CVE's 'Awaiting Analysis' status.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46171 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46171

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46171 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46171

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1d57ab45ec5c0e22789de793bcf2a31ad6fb7d98

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bd62c0f61bc722a097417401030c596cea8e21aa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.