Executive brief
A vulnerability in the Linux kernel's memory management system can cause the system to become unresponsive or crash under specific configurations. When certain debugging features are enabled, the system may fail to properly share processor time during memory cleanup operations, leading to a 'stall' that stops other tasks from running. This could result in a denial-of-service condition where the system stops responding or runs out of memory.
Technical details
The vulnerability is a resource management issue in the mm/vmalloc.c component of the Linux kernel. When CONFIG_PAGE_OWNER is enabled, the kasan_release_vmalloc_node function performs expensive stack unwinding while holding RCU read locks during the processing of large purge lists. Because the loop lacks rescheduling points, it can hold the CPU for over 10 seconds, triggering RCU stalls. An attacker or a high-load local process could trigger this condition to cause a denial-of-service or OOM state. The fix introduces periodic cond_resched() calls every 32 iterations to allow the scheduler to preempt the task and complete RCU grace periods.
Affected products
- Linux Linux Kernel All versions prior to the fix when CONFIG_PAGE_OWNER is enabled
Timeline
- 2026-01-12: disclosed: Initial patch submission by Deepanshu Kartikey
- 2026-01-26: patched: Patch committed to mainline kernel
- 2026-05-08: advisory: CVE-2026-43292 published