CVE-2026-46093 Details

A vulnerability in the Linux kernel's memory management component can lead to race conditions and potential memory leaks. The issue arises in the vmap_node_shrink_scan() function of the vmalloc memory management area. This function can be called concurrently from two different paths: one that purges vmap areas and another that shrinks vmap nodes. The decay_va_pool_node() function, responsible for managing vmap node pools, is not designed to handle concurrent execution, and the lack of proper serialization in the shrinker path can cause race conditions and memory leaks. The vulnerability affects the Linux kernel stable tree.

The vulnerability has been addressed by modifying the vmap_node_shrink_scan() function to include a mutex lock, ensuring that the decay_va_pool_node() function is not called concurrently from different paths. Users can apply the latest patches available in the Linux kernel stable tree to mitigate this vulnerability.