CVE-2026-46093

A flaw was found in the Linux kernel's memory management (vmalloc subsystem). The decay_va_pool_node() function, when invoked concurrently from the shrinker path, lacks proper serialization. This oversight can lead to race conditions, potentially resulting in memory leaks and affecting system stability.

A race in the vmalloc vmap pool shrinker can occur because decay_va_pool_node can run concurrently from the lazy purge path and the shrinker path without the same purge serialization. This can leave vmap pool state inconsistent and may leak virtual address pool resources under memory pressure. For the CVSS the PR:L is used because a local process may indirectly trigger memory pressure and shrinker activity, but reliable triggering depends on workload and timing. The issue is not network reachable. Impact is mainly local availability through resource leak or vmalloc pressure. No UAF, double free, arbitrary write, or privilege escalation primitive is shown by this patch.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.