CVE-2026-43292

{"id": "CVE-2026-43292", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43292", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:33:36.968993Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "282631cb2447318e2a55b41a665dbe8571c46d70", "lessThan": "2efa9c02c9b4c0d6866aa445f11056809b25ca28", "versionType": "git"}, {"status": "affected", "version": "282631cb2447318e2a55b41a665dbe8571c46d70", "lessThan": "1afe45f89d54b7183768ebbbbf14238ec187ab5c", "versionType": "git"}, {"status": "affected", "version": "282631cb2447318e2a55b41a665dbe8571c46d70", "lessThan": "b351fbe71091f7c8676c8ba597653d08b6719447", "versionType": "git"}, {"status": "affected", "version": "282631cb2447318e2a55b41a665dbe8571c46d70", "lessThan": "5747435e0fd474c24530ef1a6822f47e7d264b27", "versionType": "git"}], "programFiles": ["mm/vmalloc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/vmalloc.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T14:16:36.250", "references": [{"url": "https://git.kernel.org/stable/c/1afe45f89d54b7183768ebbbbf14238ec187ab5c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2efa9c02c9b4c0d6866aa445f11056809b25ca28", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5747435e0fd474c24530ef1a6822f47e7d264b27", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b351fbe71091f7c8676c8ba597653d08b6719447", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive stack unwinding that acquires RCU read\nlocks. Processing a large purge_list without rescheduling can cause the\ntask to hold CPU for extended periods (10+ seconds), leading to RCU stalls\nand potential OOM conditions.\n\nThe issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node()\nwhere iterating through hundreds or thousands of vmap_area entries and\nfreeing their associated shadow pages causes:\n\n rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l\n ...\n task:kworker/0:17 state:R running task stack:28840 pid:6229\n ...\n kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nEach call to kasan_release_vmalloc() can free many pages, and with\npage_owner tracking, each free triggers save_stack() which performs stack\nunwinding under RCU read lock. Without yielding, this creates an\nunbounded RCU critical section.\n\nAdd periodic cond_resched() calls within the loop to allow:\n- RCU grace periods to complete\n- Other tasks to run\n- Scheduler to preempt when needed\n\nThe fix uses need_resched() for immediate response under load, with a\nbatch count of 32 as a guaranteed upper bound to prevent worst-case stalls\neven under light load."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/vmalloc: evitar bloqueos de RCU en kasan_release_vmalloc_node\n\nCuando CONFIG_PAGE_OWNER est\u00e1 habilitado, liberar p\u00e1ginas en sombra de KASAN durante la limpieza de vmalloc desencadena un costoso desenrollado de pila que adquiere bloqueos de lectura de RCU. Procesar una \u2019purge_list\u2019 grande sin reprogramaci\u00f3n puede hacer que la tarea retenga la CPU por per\u00edodos prolongados (m\u00e1s de 10 segundos), lo que lleva a bloqueos de RCU y posibles condiciones de OOM.\n\nEl problema se manifiesta en purge_vmap_node() -> kasan_release_vmalloc_node() donde la iteraci\u00f3n a trav\u00e9s de cientos o miles de entradas de \u2019vmap_area\u2019 y la liberaci\u00f3n de sus p\u00e1ginas en sombra asociadas causa:\n\n rcu: INFO: rcu_preempt detect\u00f3 bloqueos en CPUs/tareas:\n rcu: Tareas bloqueadas en el \u2019rcu_node\u2019 de nivel 0 (CPUs 0-1): P6229/1:b..l\n ...\n tarea:kworker/0:17 estado:R pila de tarea en ejecuci\u00f3n:28840 pid:6229\n ...\n kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nCada llamada a kasan_release_vmalloc() puede liberar muchas p\u00e1ginas, y con el seguimiento de \u2019page_owner\u2019, cada liberaci\u00f3n desencadena save_stack() que realiza el desenrollado de pila bajo bloqueo de lectura de RCU. Sin ceder, esto crea una secci\u00f3n cr\u00edtica de RCU ilimitada.\n\nA\u00f1adir llamadas peri\u00f3dicas a cond_resched() dentro del bucle para permitir:\n- Que los per\u00edodos de gracia de RCU se completen\n- Que otras tareas se ejecuten\n- Que el planificador anticipe cuando sea necesario\n\nLa soluci\u00f3n utiliza need_resched() para una respuesta inmediata bajo carga, con un recuento de lote de 32 como un l\u00edmite superior garantizado para prevenir los peores casos de bloqueos incluso bajo carga ligera."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8A1C6F6-2847-4C53-ABFC-8F07D96900D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}