CVE-2026-46171: Linux Kernel Information Disclosure Flaw

CVE-2026-46171 Overview

CVE-2026-46171 is a memory leak vulnerability in the Linux kernel's RISC-V Kernel-based Virtual Machine (KVM) subsystem. The flaw resides in the kvm_riscv_vcpu_alloc_vector_context function, which allocates vector context memory for virtual CPUs. When the second kzalloc call for host_context.vector.datap fails, the function returns without freeing the previously allocated guest_context.vector.datap buffer. This results in a kernel memory leak each time the allocation partially fails. Maintainers resolved the issue by freeing the first allocation before returning on failure.

Critical Impact
Repeated allocation failures during RISC-V VCPU initialization can exhaust kernel memory, degrading host stability and KVM availability.

Affected Products

Linux kernel RISC-V architecture with KVM support enabled
Kernel branches addressed by commits 1d57ab4, b7c958d, and bd62c0f
RISC-V hosts running virtualized guests with vector extension support

Discovery Timeline

2026-05-28 - CVE-2026-46171 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46171

Vulnerability Analysis

The vulnerability is a kernel memory leak in the RISC-V KVM vector context allocation path. The kvm_riscv_vcpu_alloc_vector_context function performs two sequential kzalloc calls to allocate datap buffers for the guest and host vector contexts. The function correctly handles the success path but fails to clean up the first allocation when the second one fails. Each failed initialization attempt leaks a vector-sized kernel buffer that cannot be reclaimed until reboot.

The defect falls under [CWE-401] missing release of memory after effective lifetime. While the vulnerability does not enable code execution or privilege escalation, sustained exploitation through repeated VCPU creation failures can lead to resource exhaustion on the host.

Root Cause

The root cause is an incomplete error-handling path in kvm_riscv_vcpu_alloc_vector_context. The code allocates guest_context.vector.datap first and host_context.vector.datap second. If the second kzalloc returns NULL, the function returns -ENOMEM without invoking kfree on the first buffer. The fix introduces the missing kfree(guest_context.vector.datap) call on the error return path.

Attack Vector

Exploitation requires local access to a RISC-V host running KVM. A user with permission to create virtual machines can repeatedly trigger VCPU initialization under memory pressure to force the second allocation to fail. Each failure leaks kernel memory. The attack does not cross trust boundaries on its own but contributes to denial-of-service conditions in multi-tenant virtualization environments.

No verified proof-of-concept code is published. The vulnerability mechanism is described in the upstream commits referenced in the Kernel Git Commit 1d57ab4, Kernel Git Commit b7c958d, and Kernel Git Commit bd62c0f.

Detection Methods for CVE-2026-46171

Indicators of Compromise

Growing unreclaimable kernel slab memory on RISC-V KVM hosts, particularly in caches backing vector context allocations.
Repeated -ENOMEM returns from VCPU creation ioctl calls in dmesg or audit logs.
Unexplained reduction in MemAvailable reported by /proc/meminfo correlated with VM lifecycle activity.

Detection Strategies

Compare running kernel versions against the patched commits (1d57ab4, b7c958d, bd62c0f) using uname -r and distribution package metadata.
Enable kmemleak on test systems to identify outstanding allocations originating from kvm_riscv_vcpu_alloc_vector_context.
Track KVM ioctl failure rates per tenant to surface abnormal VCPU creation patterns.

Monitoring Recommendations

Alert on sustained growth in Slab and SUnreclaim values on hypervisors hosting RISC-V guests.
Monitor KVM-related kernel log entries for allocation failure messages and correlate with VM management actions.
Apply rate limits to VM creation APIs in multi-tenant environments to reduce the impact of repeated failed initializations.

How to Mitigate CVE-2026-46171

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 1d57ab4, b7c958d, and bd62c0f to all RISC-V hosts running KVM.
Restrict VM creation privileges to trusted operators and service accounts on affected hypervisors.
Schedule reboots of long-running RISC-V hypervisors to reclaim leaked kernel memory until patches are deployed.

Patch Information

The fix is committed upstream in the stable Linux kernel tree. Review the Kernel Git Commit 1d57ab4, Kernel Git Commit b7c958d, and Kernel Git Commit bd62c0f for backport candidates. Distribution maintainers should publish updated kernel packages that include these commits.

Workarounds

Disable KVM on RISC-V hosts that do not require virtualization until patched kernels are available.
Limit guest VCPU counts and vector extension exposure to reduce the frequency of vector context allocations.
Apply cgroup memory limits to KVM management processes to contain the impact of leaked allocations.

bash

# Verify running kernel version and check for the fix commits
uname -r

# Inspect kernel slab usage on a RISC-V KVM host
grep -E 'Slab|SUnreclaim|SReclaimable' /proc/meminfo

# Enable kmemleak scanning (requires CONFIG_DEBUG_KMEMLEAK=y)
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak