Executive brief
A vulnerability was identified in the Linux kernel's memory management system specifically affecting Uniprocessor (UP) systems. When the system performs certain high-priority tasks (Non-Maskable Interrupts), it could accidentally corrupt its own internal memory tracking, potentially leading to system instability or crashes. This issue primarily impacts specialized or older hardware configurations running single-core processors.
Technical details
In Linux kernels configured for Uniprocessor (UP) systems (!CONFIG_SMP), the spin_trylock() function is implemented as a no-op that always returns success. This creates a re-entrancy vulnerability in the slab allocator (mm/slub.c). If an NMI (Non-Maskable Interrupt) occurs while the kernel is already holding a slab lock (n->list_lock) and the NMI handler calls kmalloc_nolock(), the allocator will incorrectly 'succeed' in acquiring the already-held lock. This leads to re-entry of the allocator and subsequent corruption of the slab state. The fix involves an explicit check to return NULL early if kmalloc_nolock() is invoked from an NMI on a UP kernel.
Affected products
- Linux Linux Kernel All versions prior to the fix on Uniprocessor (UP) configurations
Timeline
- 2026-04-27: patched: Initial fix committed to the kernel tree.
- 2026-05-27: disclosed: CVE-2026-46029 published.