CVE-2026-43292 Overview
CVE-2026-43292 is a Linux kernel denial-of-service vulnerability in the mm/vmalloc subsystem. The flaw resides in kasan_release_vmalloc_node() when invoked from purge_vmap_node() during vmalloc cleanup. When CONFIG_PAGE_OWNER is enabled, freeing Kernel Address Sanitizer (KASAN) shadow pages triggers expensive stack unwinding under Read-Copy-Update (RCU) read locks. Processing a large purge_list without rescheduling causes the task to hold the CPU for 10+ seconds, producing RCU stalls and potential out-of-memory (OOM) conditions.
Critical Impact
A local unprivileged workload can induce sustained RCU stalls and CPU starvation, degrading system availability on kernels built with CONFIG_PAGE_OWNER and KASAN.
Affected Products
- Linux Kernel (upstream stable branches) prior to the fix commits
- Distributions shipping kernels with CONFIG_PAGE_OWNER and KASAN enabled
- Kernel builds invoking purge_vmap_node() against large vmalloc purge lists
Discovery Timeline
- 2026-05-08 - CVE-2026-43292 published to the National Vulnerability Database (NVD)
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-43292
Vulnerability Analysis
The issue manifests in purge_vmap_node() calling kasan_release_vmalloc_node() at mm/vmalloc.c:2299. Each invocation can free many shadow pages associated with vmap_area entries. With CONFIG_PAGE_OWNER enabled, every page free triggers save_stack(), which performs stack unwinding while holding an RCU read lock.
Iterating through hundreds or thousands of vmap_area entries without yielding produces an unbounded RCU critical section. The kernel logs rcu_preempt detected stalls on CPUs/tasks and the offending worker remains in the running state for extended periods. Other tasks are starved, RCU grace periods cannot complete, and memory reclaim stalls — creating conditions for OOM.
Root Cause
The root cause is the absence of preemption points inside the shadow-page freeing loop. kasan_release_vmalloc_node() performs work proportional to the size of the vmalloc purge list while implicitly extending RCU read-side critical sections through save_stack() calls. Under load, the loop never voluntarily yields, violating the kernel's expectation that long-running kernel paths offer rescheduling opportunities.
Attack Vector
Exploitation requires local access and the ability to trigger sizable vmalloc allocations and frees that populate the purge list. The vulnerability is restricted to kernels compiled with both KASAN and CONFIG_PAGE_OWNER, which is typical of debug, fuzzing, and syzkaller-style test kernels rather than production builds. The result is availability impact only — no confidentiality or integrity loss.
No public proof-of-concept code is associated with this CVE. The condition was reproduced through standard kernel workloads producing large purge_list batches, as documented in the upstream commit messages.
Detection Methods for CVE-2026-43292
Indicators of Compromise
- Kernel log entries containing rcu: INFO: rcu_preempt detected stalls on CPUs/tasks correlated with kasan_release_vmalloc_node and purge_vmap_node stack frames
- kworker threads observed in the R running state for 10+ seconds with stacks rooted in mm/vmalloc.c
- OOM killer activations following prolonged RCU grace period delays on KASAN-enabled kernels
Detection Strategies
- Parse dmesg and /var/log/kern.log for RCU stall warnings referencing vmalloc or KASAN release paths
- Sample /proc/<pid>/stack of long-running kworker threads and flag those terminating in kasan_release_vmalloc_node
- Correlate scheduler latency spikes with kernel build flags CONFIG_KASAN=y and CONFIG_PAGE_OWNER=y
Monitoring Recommendations
- Ingest kernel ring buffer events into a centralized logging pipeline and alert on RCU stall signatures
- Track per-CPU softlockup and rcu_preempt counters via node_exporter or equivalent telemetry
- Audit kernel .config settings across fleet hosts to identify systems running KASAN with CONFIG_PAGE_OWNER enabled
How to Mitigate CVE-2026-43292
Immediate Actions Required
- Apply the upstream stable patches that introduce periodic cond_resched() calls inside kasan_release_vmalloc_node()
- Disable CONFIG_PAGE_OWNER on KASAN-enabled kernels where page-owner tracking is not required for debugging
- Rebuild and redeploy affected debug kernels; production kernels without KASAN are not impacted
Patch Information
The fix adds periodic cond_resched() invocations within the shadow-page release loop, gated by need_resched() for immediate responsiveness and a batch count of 32 as a guaranteed upper bound. This allows RCU grace periods to complete and the scheduler to preempt the worker. Patches are available in the upstream commits 1afe45f, 2efa9c0, 5747435, and b351fbe.
Workarounds
- Rebuild the kernel without CONFIG_PAGE_OWNER to eliminate the save_stack() cost in the release path
- Avoid running KASAN debug kernels in latency-sensitive or shared multi-tenant environments until patched
- Constrain workloads that generate large vmalloc purge lists, such as repeated module load/unload cycles, on unpatched debug kernels
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
