{"id":"CVE-2026-43292","title":"mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive st…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 2efa9c02c9b4c0d6866aa445f11056809b25ca28","Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 1afe45f89d54b7183768ebbbbf14238ec187ab5c","Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < b351fbe71091f7c8676c8ba597653d08b6719447","Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 5747435e0fd474c24530ef1a6822f47e7d264b27","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:33:36.968993Z"},"published":"2026-05-08","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:47.184Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43292","references":[{"url":"https://git.kernel.org/stable/c/2efa9c02c9b4c0d6866aa445f11056809b25ca28"},{"url":"https://git.kernel.org/stable/c/1afe45f89d54b7183768ebbbbf14238ec187ab5c"},{"url":"https://git.kernel.org/stable/c/b351fbe71091f7c8676c8ba597653d08b6719447"},{"url":"https://git.kernel.org/stable/c/5747435e0fd474c24530ef1a6822f47e7d264b27"}],"tags":["cve.org"],"epss":0.00122,"epssPercentile":0.0198,"ingestedAt":"2026-11-06T15:54:03.947Z","slug":"CVE-2026-43292","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive stack unwinding that acquires RCU read\nlocks.  Processing a large purge_list without rescheduling can cause the\ntask to hold CPU for extended periods (10+ seconds), leading to RCU stalls\nand potential OOM conditions.\n\nThe issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node()\nwhere iterating through hundreds or thousands of vmap_area entries and\nfreeing their associated shadow pages causes:\n\n  rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n  rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l\n  ...\n  task:kworker/0:17 state:R running task stack:28840 pid:6229\n  ...\n  kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n  purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nEach call to kasan_release_vmalloc() can free many pages, and with\npage_owner tracking, each free triggers save_stack() which performs stack\nunwinding under RCU read lock.  Without yielding, this creates an\nunbounded RCU critical section.\n\nAdd periodic cond_resched() calls within the loop to allow:\n- RCU grace periods to complete\n- Other tasks to run\n- Scheduler to preempt when needed\n\nThe fix uses need_resched() for immediate response under load, with a\nbatch count of 32 as a guaranteed upper bound to prevent worst-case stalls\neven under light load.\n\n## Affected\n\n- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 2efa9c02c9b4c0d6866aa445f11056809b25ca28`\n- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 1afe45f89d54b7183768ebbbbf14238ec187ab5c`\n- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < b351fbe71091f7c8676c8ba597653d08b6719447`\n- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 5747435e0fd474c24530ef1a6822f47e7d264b27`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}