CVE-2026-46093 Overview
CVE-2026-46093 is a race condition in the Linux kernel virtual memory allocator (mm/vmalloc). The function decay_va_pool_node() can run concurrently from two code paths: __purge_vmap_area_lazy() during pool purging and vmap_node_shrink_scan() invoked by the shrinker. The shrinker path lacks serialization with purge users, allowing the two callers to operate on the same data structures simultaneously. This concurrency exposure can produce races and possible memory leaks in the virtual memory area (VMA) pool management subsystem. The upstream fix takes vmap_purge_lock in the shrinker path to serialize access.
Critical Impact
Concurrent execution of decay_va_pool_node() from the shrinker and purge paths can corrupt vmap pool state and leak kernel virtual memory resources.
Affected Products
- Linux kernel (mainline) versions containing decay_va_pool_node() in mm/vmalloc.c
- Stable kernel branches referenced by the upstream commits
- Linux distributions shipping affected stable kernel versions
Discovery Timeline
- 2026-05-27 - CVE-2026-46093 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46093
Vulnerability Analysis
The Linux kernel vmalloc subsystem manages per-node pools of cached virtual memory areas to reduce allocation overhead. The function decay_va_pool_node() shrinks these pools by releasing stale entries. Two execution paths invoke it: __purge_vmap_area_lazy() runs when lazy-purge thresholds trigger pool cleanup, and vmap_node_shrink_scan() runs under memory pressure when the shrinker reclaims cached objects.
Both callers can execute simultaneously on the same node. The purge path acquires vmap_purge_lock for serialization, but the shrinker path does not. Without that lock, two threads can mutate the same pool list concurrently, producing inconsistent state and dropping references to allocated areas. The result is races on internal counters and list pointers, with memory leaks as the observable symptom. This is a classic kernel race condition [CWE-362] in memory management code.
Root Cause
The root cause is missing lock acquisition in the shrinker callback. decay_va_pool_node() is not internally synchronized and relies on callers to hold vmap_purge_lock. The shrinker path invoked from vmap_node_shrink_scan() was added without taking that lock, breaking the implicit serialization contract.
Attack Vector
Triggering the race requires concurrent memory pressure causing the shrinker to fire while the lazy-purge path is active. Both conditions occur naturally on busy systems with heavy vmalloc/vfree workloads. No remote attack vector is documented, and no public exploit is available. The practical impact is reliability, with kernel virtual address space leaks reducing system stability over time.
No verified proof-of-concept code is published. The vulnerability is described in the upstream commit messages referenced by the kernel.org stable commit.
Detection Methods for CVE-2026-46093
Indicators of Compromise
- Unexpected growth in /proc/vmallocinfo entries that do not correspond to active allocations
- Rising nr_vmalloc_pages counters in /proc/meminfo without matching workload growth
- Soft lockups or warnings originating from mm/vmalloc.c under heavy memory pressure
Detection Strategies
- Audit the running kernel version against the fixed commits 12f2341b, 687ccdf5, and ec05f51f published on kernel.org
- Track virtual memory address space exhaustion over uptime windows on long-running hosts
- Correlate kernel ring buffer warnings from the vmalloc subsystem with shrinker activity
Monitoring Recommendations
- Collect cat /proc/meminfo and /proc/vmallocinfo metrics on a recurring interval and alert on monotonic growth
- Forward kernel logs to a centralized data lake and search for vmalloc and vmap warning patterns
- Monitor uptime correlated with memory reclaim pressure to identify hosts most exposed to the race
How to Mitigate CVE-2026-46093
Immediate Actions Required
- Identify Linux hosts running stable kernels that predate the fix commits referenced on kernel.org
- Apply vendor-supplied kernel updates from your Linux distribution as soon as they are released
- Schedule reboots on long-running hosts after patch installation to load the corrected kernel
Patch Information
The fix takes vmap_purge_lock inside the shrinker path so decay_va_pool_node() is serialized with __purge_vmap_area_lazy(). The upstream commits are available at commit 12f2341b, commit 687ccdf5, and commit ec05f51f. Distribution maintainers will backport these commits into supported stable trees.
Workarounds
- No supported configuration workaround exists because the locking defect is in core kernel memory management code
- Reduce exposure by limiting workloads that generate sustained vmalloc churn under memory pressure on unpatched hosts
- Schedule periodic reboots on unpatched long-running systems to reclaim leaked virtual address space until the patch is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
