CVE-2026-43258

{"id": "CVE-2026-43258", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "01cddfc34bf2a813a2773f1d607305515be55409", "versionType": "git"}, {"status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "5593c9b255ae73f57a8b5e696a660032acbd67da", "versionType": "git"}, {"status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6", "versionType": "git"}, {"status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f", "versionType": "git"}, {"status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "bab8d762a8dbb816b10011e13b87d1bca91e5f77", "versionType": "git"}, {"status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "dd5712f3379cfe760267cdd28ff957d9ab4e51c7", "versionType": "git"}], "programFiles": ["arch/alpha/include/asm/pgtable.h", "arch/alpha/include/asm/tlbflush.h", "arch/alpha/mm/Makefile", "arch/alpha/mm/tlbflush.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/alpha/include/asm/pgtable.h", "arch/alpha/include/asm/tlbflush.h", "arch/alpha/mm/Makefile", "arch/alpha/mm/tlbflush.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:46.650", "references": [{"url": "https://git.kernel.org/stable/c/01cddfc34bf2a813a2773f1d607305515be55409", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5593c9b255ae73f57a8b5e696a660032acbd67da", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bab8d762a8dbb816b10011e13b87d1bca91e5f77", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dd5712f3379cfe760267cdd28ff957d9ab4e51c7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nalpha: fix user-space corruption during memory compaction\n\nAlpha systems can suffer sporadic user-space crashes and heap\ncorruption when memory compaction is enabled.\n\nSymptoms include SIGSEGV, glibc allocator failures (e.g. \"unaligned\ntcache chunk\"), and compiler internal errors. The failures disappear\nwhen compaction is disabled or when using global TLB invalidation.\n\nThe root cause is insufficient TLB shootdown during page migration.\nAlpha relies on ASN-based MM context rollover for instruction cache\ncoherency, but this alone is not sufficient to prevent stale data or\ninstruction translations from surviving migration.\n\nFix this by introducing a migration-specific helper that combines:\n - MM context invalidation (ASN rollover),\n - immediate per-CPU TLB invalidation (TBI),\n - synchronous cross-CPU shootdown when required.\n\nThe helper is used only by migration/compaction paths to avoid changing\nglobal TLB semantics.\n\nAdditionally, update flush_tlb_other(), pte_clear(), to use\nREAD_ONCE()/WRITE_ONCE() for correct SMP memory ordering.\n\nThis fixes observed crashes on both UP and SMP Alpha systems."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nalpha: soluciona la corrupci\u00f3n del espacio de usuario durante la compactaci\u00f3n de memoria\n\nLos sistemas Alpha pueden sufrir fallos espor\u00e1dicos del espacio de usuario y corrupci\u00f3n del heap cuando la compactaci\u00f3n de memoria est\u00e1 habilitada.\n\nLos s\u00edntomas incluyen SIGSEGV, fallos del asignador de glibc (p. ej., \u2019fragmento de tcache no alineado\u2019), y errores internos del compilador. Los fallos desaparecen cuando la compactaci\u00f3n est\u00e1 deshabilitada o cuando se utiliza la invalidaci\u00f3n global de la TLB.\n\nLa causa ra\u00edz es un TLB shootdown insuficiente durante la migraci\u00f3n de p\u00e1ginas. Alpha se basa en el rollover de contexto MM basado en ASN para la coherencia de la cach\u00e9 de instrucciones, pero esto por s\u00ed solo no es suficiente para evitar que datos obsoletos o traducciones de instrucciones sobrevivan a la migraci\u00f3n.\n\nEsto se soluciona introduciendo un ayudante espec\u00edfico para la migraci\u00f3n que combina:\n - invalidaci\u00f3n del contexto MM (rollover de ASN),\n - invalidaci\u00f3n inmediata de la TLB por CPU (TBI),\n - shootdown s\u00edncrono entre CPUs cuando sea necesario.\n\nEl ayudante se utiliza solo por rutas de migraci\u00f3n/compactaci\u00f3n para evitar cambiar la sem\u00e1ntica global de la TLB.\n\nAdem\u00e1s, se actualiza flush_tlb_other(), pte_clear(), para usar READ_ONCE()/WRITE_ONCE() para una correcta ordenaci\u00f3n de memoria SMP.\n\nEsto soluciona los fallos observados tanto en sistemas Alpha UP como SMP."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B61C2D7F-08C5-489E-8C29-2AFB211FF84B", "versionEndExcluding": "6.12.75", "versionStartIncluding": "2.6.16.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBF2513D-8F4F-4ED5-ADCE-9933F34F1BFB"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC3639E1-B5E4-4DD6-80D4-BA07D192C42D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54393D69-B368-4296-9798-D81570495C6C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6791A801-9E06-47DD-912F-D8594E2F6B3F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE90CCED-3A5B-46E3-A6B0-4865AB786289"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBFF6DE7-6D7C-469A-9B2D-2F6E915F55B0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0CD4E4B-E756-4401-A352-871EBA5B8680"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}