CVE-2026-46035: Linux Kernel Race Condition Vulnerability

CVE-2026-46035 Overview

CVE-2026-46035 affects the Linux kernel memory allocator on uniprocessor (UP) builds where CONFIG_SMP is disabled. The flaw resides in alloc_frozen_pages_nolock(), which can be invoked from non-maskable interrupt (NMI) context. On UP kernels, spin_trylock() is a no-op that unconditionally succeeds, allowing the NMI handler to re-enter rmqueue() and acquire a zone lock already held by the interrupted context. The result is corruption of the page allocator freelists.

Critical Impact
Freelist corruption in the page allocator can lead to memory management instability, kernel panics, and potential local denial of service on affected UP Linux systems.

Affected Products

Linux kernel builds with !CONFIG_SMP (uniprocessor configurations)
Linux kernel versions containing the alloc_frozen_pages_nolock() allocation path
Stable kernel branches prior to commits 05b4ed8, 620b46e, and a6d57ef

Discovery Timeline

2026-05-27 - CVE-2026-46035 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46035

Vulnerability Analysis

The vulnerability is a re-entrancy flaw in the Linux kernel page allocator [CWE-667 lock handling class]. On uniprocessor kernels, the spinlock implementation collapses spin_trylock() into a no-op that always returns success. The kernel relies on spin_trylock() inside alloc_frozen_pages_nolock() to detect contention and bail out safely. That safety check vanishes on UP, so an NMI that fires while the interrupted context holds a zone lock can proceed into rmqueue() and mutate shared freelist state.

The reporter reproduced the issue with the slub_kunit test module under CONFIG_DEBUG_SPINLOCK. The debug check emitted: BUG: spinlock trylock failure on UP on CPU#0, with a stack trace through do_raw_spin_trylock → rmqueue.isra.0 → get_page_from_freelist → alloc_frozen_pages_nolock_noprof → kmalloc_nolock_noprof inside an <NMI> frame.

Root Cause

The root cause is the UP kernel's optimization of spin_trylock() to unconditionally succeed. Code paths reachable from NMI assumed spin_trylock() would fail when a lock was already held, which is true on SMP but not on UP. Without that guarantee, the NMI-reachable allocator path nests inside a critical section that already holds the zone lock, violating freelist invariants.

Attack Vector

Triggering the condition requires kernel code paths that invoke kmalloc_nolock() or related allocators from NMI context while the interrupted thread holds a zone lock. Local workloads that generate NMIs during slab allocation pressure on a UP kernel can deterministically reach the corrupted state. The fix returns NULL early from alloc_frozen_pages_nolock() when the function is invoked from NMI on a UP kernel, preserving freelist integrity at the cost of a failed nolock allocation in that narrow window.

Refer to the upstream patches for the exact change: Kernel commit 05b4ed8, Kernel commit 620b46e, and Kernel commit a6d57ef.

Detection Methods for CVE-2026-46035

Indicators of Compromise

Kernel log entries containing BUG: spinlock trylock failure on UP originating from do_raw_spin_trylock.
Call traces with <NMI> frames passing through rmqueue, get_page_from_freelist, and alloc_frozen_pages_nolock_noprof.
Unexpected kernel panics or BUG_ON triggers in mm/page_alloc.c on uniprocessor systems.

Detection Strategies

Audit running kernels for !CONFIG_SMP builds combined with versions predating the fix commits.
Enable CONFIG_DEBUG_SPINLOCK in test environments to surface the trylock-on-UP assertion before deployment.
Run the slub_kunit kernel self-test to reproduce the BUG path on candidate kernel builds.

Monitoring Recommendations

Forward kern.log and dmesg output to a central log store and alert on spinlock trylock failure strings.
Monitor for kernel oops and panic events on embedded or single-CPU virtualized hosts where UP kernels are common.
Track kernel package versions across the fleet to identify hosts running pre-patch builds.

How to Mitigate CVE-2026-46035

Immediate Actions Required

Identify hosts running uniprocessor Linux kernels and prioritize them for patching.
Apply the stable kernel update containing commits 05b4ed8, 620b46e, or a6d57ef from the upstream tree.
Reboot affected systems after package installation to load the patched kernel image.

Patch Information

The upstream fix returns NULL early from alloc_frozen_pages_nolock() when called from NMI context on UP kernels, preventing re-entry into rmqueue(). The change is distributed across the following commits: 05b4ed8, 620b46e, and a6d57ef. Distribution maintainers have backported these commits into their stable kernel series.

Workarounds

Rebuild affected kernels with CONFIG_SMP=y where the hardware supports it, which restores the real spin_trylock() semantics.
Disable kernel modules or features that issue kmalloc_nolock() allocations from NMI handlers until the patched kernel is deployed.
Restrict local code execution on impacted hosts to reduce the chance of triggering the NMI-reachable allocation path.

bash

# Verify kernel SMP configuration and version against the fix
uname -a
grep CONFIG_SMP /boot/config-$(uname -r)
# Apply distribution kernel updates, then reboot
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot