CVE-2026-46042 Overview
CVE-2026-46042 is a memory leak vulnerability in the Linux kernel's memory policy subsystem. The flaw resides in the weighted_interleave_auto_store() function within mm/mempolicy, which incorrectly handles allocation of old_wi_state and new_wi_state structures. The function fetches old_wi_state only inside the if (!input) block, leading to two distinct leak paths when userspace writes to the associated sysfs interface. A local user can trigger the leaks repeatedly by writing values such as 1 in a loop, gradually exhausting kernel memory.
Critical Impact
Repeated writes to the weighted interleave auto interface leak kernel memory on every invocation, enabling a local user to drive resource exhaustion against the host.
Affected Products
- Linux kernel (mainline) versions containing the weighted_interleave_auto_store() implementation in mm/mempolicy
- Linux stable trees prior to the commits listed in the kernel.org references
- Distributions shipping vulnerable stable kernels until backports are applied
Discovery Timeline
- 2026-05-27 - CVE-2026-46042 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46042
Vulnerability Analysis
The vulnerability is a memory leak [CWE-401] in the Linux memory policy subsystem. The weighted_interleave_auto_store() handler manages transitions between automatic and manual weighted interleave modes for NUMA memory allocation. The handler allocates a new state structure (new_wi_state) and is expected to atomically swap it with the existing old_wi_state via rcu_assign_pointer(), then free the old state after an RCU grace period.
The defect lies in conditional fetching of old_wi_state. The original code only retrieves the existing state inside the if (!input) branch, which corresponds to the user writing false. Two leak conditions result from this control flow error. First, when a user writes false while the mode is already manual, the function returns early without freeing the newly allocated new_wi_state. Second, when a user writes true, old_wi_state is never fetched, remains NULL, and the existing state is overwritten by rcu_assign_pointer() without being released. The cleanup path is gated on old_wi_state being non-NULL, so it never executes.
Root Cause
The root cause is improper lifecycle management of dynamically allocated kernel objects in a sysfs store handler. The fetch of old_wi_state is conditional rather than unconditional, breaking the invariant that any successful allocation or pointer swap must be paired with a corresponding free.
Attack Vector
An attacker with local access and permission to write to the weighted interleave sysfs node can call the handler repeatedly. Each write that satisfies either leak condition leaks one state structure. Looping the write of 1 accumulates leaks until kernel memory pressure causes degradation or denial of service. No special privileges beyond sysfs write access are required.
The upstream fix moves the old_wi_state fetch before the input check, making it unconditional, and adds a unified early return when the requested mode matches the current mode. See the kernel commit 39caa9c for the patch.
Detection Methods for CVE-2026-46042
Indicators of Compromise
- Steady growth in kernel slab memory consumption visible through /proc/slabinfo or slabtop without a corresponding workload
- Repeated userspace writes to the weighted interleave auto sysfs node, particularly tight loops writing 0, 1, true, or false
- Increasing MemAvailable decline on NUMA systems running affected kernels
Detection Strategies
- Audit running kernel versions across the fleet and compare against the patched commits 39caa9c, 6fae274c, and c42a7efb
- Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in test environments to confirm presence of the defect
- Monitor process telemetry for shells or scripts repeatedly writing to mempolicy-related sysfs paths
Monitoring Recommendations
- Track kernel slab allocators related to mempolicy state structures over time and alert on sustained upward trends
- Correlate sysfs write events with user identity and command history to surface abusive patterns
- Establish a baseline for NUMA-capable hosts and alert when free memory deviates without workload changes
How to Mitigate CVE-2026-46042
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 39caa9c, 6fae274c, and c42a7efb from the stable tree
- Update to a distribution kernel that incorporates the fix for weighted_interleave_auto_store()
- Restrict write permissions on the weighted interleave sysfs interface to root or trusted administrative accounts only
Patch Information
The fix is available in the Linux kernel stable tree through the following commits: Kernel Git Commit 39caa9c, Kernel Git Commit 6fae274c, and Kernel Git Commit c42a7efb. The patch moves the old_wi_state fetch outside the conditional block and adds a unified early return path when the requested mode equals the current mode.
Workarounds
- Limit access to NUMA mempolicy sysfs nodes using filesystem permissions or namespace isolation until patches can be deployed
- Reboot affected hosts on a scheduled basis to reclaim leaked memory in environments where patching is delayed
- Disable or unmount the sysfs interface controlling weighted interleave auto mode if it is not in operational use
# Verify kernel version and check for the fix
uname -r
# Restrict access to the weighted interleave sysfs interface
chmod 600 /sys/kernel/mm/mempolicy/weighted_interleave/auto
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
