CVE-2026-46221: Linux Kernel Information Disclosure Flaw

CVE-2026-46221 Overview

CVE-2026-46221 is a memory leak vulnerability in the Linux kernel's EDAC (Error Detection and Correction) subsystem, specifically in the versalnet driver. The device name allocated via kzalloc() inside init_one_mc() is assigned to dev->init_name but never freed on the normal removal path. Because device_register() copies init_name and then sets dev->init_name to NULL, the original allocation becomes unreachable and leaks on every probe/remove cycle. The fix replaces the heap allocation with a stack-local character array, eliminating the leak entirely.

Critical Impact
Repeated probe and removal of the EDAC versalnet driver leaks kernel memory, contributing to long-term resource exhaustion on affected systems.

Affected Products

Linux kernel versions containing the EDAC versalnet driver prior to the patched commits
AMD/Xilinx Versal NET platforms using EDAC memory controller support
Stable kernel branches tracked by commits 24d2912, 8cf5dd2, and b16033c

Discovery Timeline

2026-05-28 - CVE-2026-46221 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46221

Vulnerability Analysis

The EDAC subsystem in the Linux kernel reports hardware memory errors detected by the platform's memory controller. The versalnet driver provides this support for AMD Versal NET devices. During initialization, init_one_mc() allocates a buffer using kzalloc() to hold the device name, then assigns the pointer to dev->init_name.

The core device model treats init_name as a transient field. When device_register() runs, it copies the string into the device's permanent name storage and then sets dev->init_name = NULL. The original heap pointer is no longer referenced by any kernel data structure, so the standard removal path cannot free it. Each bind/unbind cycle of the driver therefore leaks the allocated buffer.

Root Cause

The defect is an [CWE-401] missing release of memory after effective lifetime. The driver assumed init_name retained ownership of the allocation, but the device model semantics invalidate that pointer during registration. No corresponding kfree() exists on the removal path because there is no remaining reference to free.

Attack Vector

The vulnerability requires local access to load, unload, or rebind the versalnet EDAC driver, an operation typically restricted to root. It does not enable code execution or privilege escalation. Repeated driver reload cycles, scripted hotplug events, or fault-injection testing can amplify the leak over time and reduce available kernel memory. The patched code removes the allocation entirely by using a stack-local character array passed into the device registration helper.

Detection Methods for CVE-2026-46221

Indicators of Compromise

Growth of kmalloc-* slab caches correlated with repeated load/unload of the edac_versalnet module
kmemleak reports referencing allocations originating in init_one_mc() within the EDAC versalnet driver
Gradual reduction of MemAvailable in /proc/meminfo on systems that frequently rebind EDAC devices

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and scan /sys/kernel/debug/kmemleak for unreferenced allocations attributed to the EDAC versalnet driver
Compare installed kernel build hashes against the fixed commits 24d2912962d0, 8cf5dd235eff, and b16033c8774f
Use slabtop and /proc/slabinfo to baseline allocation counts across driver bind/unbind cycles

Monitoring Recommendations

Track kernel memory utilization on Versal NET platforms running long-lived workloads
Audit dmesg for repeated EDAC versalnet probe and remove events that could compound the leak
Forward kernel telemetry to a centralized log platform to correlate memory growth with driver lifecycle events

How to Mitigate CVE-2026-46221

Immediate Actions Required

Update affected systems to a Linux kernel containing commits 24d2912962d087ebff7c4984f8ac34a5f23c8dbf, 8cf5dd235eff6008cb04c3d8064d2acfa90616f1, or b16033c8774f5fb4c0cb9b445a1dfc68f499ae6a
Avoid unnecessary unbind/rebind cycles of the edac_versalnet driver until patched kernels are deployed
Restrict module load and device hotplug operations to privileged administrators

Patch Information

The upstream fix replaces the kzalloc()-based name buffer in init_one_mc() with a stack-local char array, eliminating the leaked allocation. Patched commits are available from the stable kernel tree: Kernel Git Commit 24d2912, Kernel Git Commit 8cf5dd2, and Kernel Git Commit b16033c.

Workarounds

Unload the edac_versalnet module on systems that do not require EDAC reporting for Versal NET hardware
Schedule periodic reboots on systems where the patched kernel cannot yet be deployed to reclaim leaked memory
Blacklist the driver via /etc/modprobe.d/ where EDAC functionality is not operationally required

bash

# Configuration example
# Verify whether the EDAC versalnet driver is loaded
lsmod | grep edac_versalnet

# Temporarily unload the driver where EDAC is not required
sudo modprobe -r edac_versalnet

# Persistently blacklist the driver until a patched kernel is installed
echo 'blacklist edac_versalnet' | sudo tee /etc/modprobe.d/blacklist-edac-versalnet.conf

# Confirm running kernel version against patched stable releases
uname -r