CVE-2026-46093

mm/vmalloc: take vmap_purge_lock in shrinker

High · published May 27, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: take vmap_purge_lock in shrinker

decay_va_pool_node() can be invoked concurrently from two paths:

__purge_vmap_area_lazy() when pools are being purged, and the shrinker via

vmap_node_shrink_scan().

However, decay_va_pool_node() is not safe to run concurrently, and the

shrinker path currently lacks serialization, leading to races and possible

leaks.

Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker

path to ensure serialization with purge users.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00129 · 2.3th percentile
Published
2026-05-27T12:58Z
EPSS history
Timeline
  • 27 MAY 12:58Z
    mm/vmalloc: take vmap_purge_lock in shrinker
    cvelistv5