Executive brief
A vulnerability in the Linux kernel's handling of 'shadow stacks' on x86 processors could allow a local user to cause a system deadlock. Shadow stacks are a security feature designed to prevent certain types of cyberattacks; however, a flaw in how the kernel manages memory locks during specific signal operations can cause the system to hang. This results in a denial-of-service, potentially requiring a hard reboot and disrupting operations.
Technical details
A deadlock condition exists in the Linux kernel's x86 shadow stack (shstk) implementation within the 'shstk_pop_sigframe' function. During a sigreturn, the kernel attempts to read the shadow stack signal frame while holding the 'mmap_read_lock'. If this access triggers a page fault, the fault handler attempts to acquire the same lock recursively. While recursive read locks are generally permitted, a deadlock occurs if a writer (e.g., another thread performing an mmap operation) is simultaneously waiting for the lock on a different CPU. The fix involves using speculative mmap locking (mmap_lock_speculate) to verify VMA integrity without holding the lock during userspace access. The fix also makes X86_USER_SHADOW_STACK dependent on PER_VMA_LOCK.
Affected products
- Linux Linux Kernel x86_64 with X86_USER_SHADOW_STACK enabled
Timeline
- 2026-04-09: patched: Initial patch authored by Rick Edgecombe
- 2026-05-27: disclosed: CVE-2026-46063 published
References
- https://git.kernel.org/stable/c/3d29db827502067626062f5c74dd502d14ab15bc
- https://git.kernel.org/stable/c/4f3374c990fb2adec06d20fd6d780927811c9aa0
- https://git.kernel.org/stable/c/9874b2917b9fbc30956fee209d3c4aa47201c64e
- https://git.kernel.org/stable/c/d042d69b417515959e49021fef008c9b04a99bd5
- https://git.kernel.org/stable/c/e2c2b044458cbf22da05264fa707308e8d4f86f9