Executive brief
A vulnerability was identified in the Linux kernel's memory management system affecting single-processor systems. Under specific conditions, the system could incorrectly allow simultaneous access to internal memory lists, leading to data corruption. This could result in system instability, crashes, or unpredictable behavior during normal operations.
Technical details
A re-entrancy vulnerability exists in the Linux kernel's mm/page_alloc.c component on uniprocessor (UP) kernels where CONFIG_SMP is disabled. In these configurations, spin_trylock() is implemented as a no-op that always succeeds. If alloc_frozen_pages_nolock() is triggered within a Non-Maskable Interrupt (NMI) context while the interrupted code already holds a zone lock, it can re-enter rmqueue() and corrupt the freelists. This occurs because the lock appears available to the NMI context despite being held by the interrupted task. The fix introduces an early NULL return when the function is invoked from an NMI on a UP kernel to prevent this unsafe re-entrancy.
Affected products
- Linux Linux Kernel Uniprocessor (UP) configurations without CONFIG_SMP
Timeline
- 2026-04-27: disclosed: Initial patch submission by Harry Yoo (Oracle)
- 2026-05-27: advisory: CVE-2026-46035 published by NVD