Executive brief
A race condition was identified in the Linux kernel's memory management system. The flaw occurs when the system attempts to clean up virtual memory pools simultaneously from two different processes. If exploited, this could lead to memory leaks, potentially causing system instability or a denial of service over time as available memory is exhausted.
Technical details
A race condition exists in the mm/vmalloc.c component of the Linux kernel. The function decay_va_pool_node() can be invoked concurrently by __purge_vmap_area_lazy() (during pool purging) and vmap_node_shrink_scan() (via the kernel shrinker). Because decay_va_pool_node() is not thread-safe and the shrinker path lacked proper locking, concurrent execution leads to data races and potential memory leaks. The fix introduces the use of vmap_purge_lock within the vmap_node_shrink_scan() function to ensure proper serialization. This is primarily a local stability issue.
Affected products
- Linux Linux Kernel Fixed in 12f2341, 687ccdf, ec05f51
Timeline
- 2026-04-13: other: Patch submitted by Uladzislau Rezki
- 2026-05-27: disclosed: CVE published by kernel.org