Concurrency Vulnerability in Linux Kernel Affecting Memory Management

CVE-2026-46093

What is CVE-2026-46093?

A concurrency vulnerability exists in the memory management subsystem of the Linux kernel, specifically within the decay_va_pool_node() function. The function can be invoked concurrently from two different execution paths, leading to potential race conditions and memory leaks. This issue arises during the execution of __purge_vmap_area_lazy() and via the shrinker through vmap_node_shrink_scan(), where inadequate serialization poses risks to system stability. To address this vulnerability, the vmap_purge_lock must be acquired in the shrinker path, ensuring safe concurrent execution and preventing data corruption.

References