---
id: CVE-2026-43292
title: 'mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node

  When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during
  vmalloc cleanup triggers expensive st…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 <
    2efa9c02c9b4c0d6866aa445f11056809b25ca28
  - >-
    Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 <
    1afe45f89d54b7183768ebbbbf14238ec187ab5c
  - >-
    Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 <
    b351fbe71091f7c8676c8ba597653d08b6719447
  - >-
    Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 <
    5747435e0fd474c24530ef1a6822f47e7d264b27
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:33:36.968993Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:47.184Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43292'
references:
  - url: 'https://git.kernel.org/stable/c/2efa9c02c9b4c0d6866aa445f11056809b25ca28'
  - url: 'https://git.kernel.org/stable/c/1afe45f89d54b7183768ebbbbf14238ec187ab5c'
  - url: 'https://git.kernel.org/stable/c/b351fbe71091f7c8676c8ba597653d08b6719447'
  - url: 'https://git.kernel.org/stable/c/5747435e0fd474c24530ef1a6822f47e7d264b27'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.0198
ingestedAt: '2026-11-06T15:54:03.947Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node

When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during
vmalloc cleanup triggers expensive stack unwinding that acquires RCU read
locks.  Processing a large purge_list without rescheduling can cause the
task to hold CPU for extended periods (10+ seconds), leading to RCU stalls
and potential OOM conditions.

The issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node()
where iterating through hundreds or thousands of vmap_area entries and
freeing their associated shadow pages causes:

  rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
  rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l
  ...
  task:kworker/0:17 state:R running task stack:28840 pid:6229
  ...
  kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299
  purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299

Each call to kasan_release_vmalloc() can free many pages, and with
page_owner tracking, each free triggers save_stack() which performs stack
unwinding under RCU read lock.  Without yielding, this creates an
unbounded RCU critical section.

Add periodic cond_resched() calls within the loop to allow:
- RCU grace periods to complete
- Other tasks to run
- Scheduler to preempt when needed

The fix uses need_resched() for immediate response under load, with a
batch count of 32 as a guaranteed upper bound to prevent worst-case stalls
even under light load.

## Affected

- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 2efa9c02c9b4c0d6866aa445f11056809b25ca28`
- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 1afe45f89d54b7183768ebbbbf14238ec187ab5c`
- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < b351fbe71091f7c8676c8ba597653d08b6719447`
- `Linux >= 282631cb2447318e2a55b41a665dbe8571c46d70 < 5747435e0fd474c24530ef1a6822f47e7d264b27`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.