{"id":"CVE-2026-43292","summary":"mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive stack unwinding that acquires RCU read\nlocks.  Processing a large purge_list without rescheduling can cause the\ntask to hold CPU for extended periods (10+ seconds), leading to RCU stalls\nand potential OOM conditions.\n\nThe issue manifests in purge_vmap_node() -\u003e kasan_release_vmalloc_node()\nwhere iterating through hundreds or thousands of vmap_area entries and\nfreeing their associated shadow pages causes:\n\n  rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n  rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l\n  ...\n  task:kworker/0:17 state:R running task stack:28840 pid:6229\n  ...\n  kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n  purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nEach call to kasan_release_vmalloc() can free many pages, and with\npage_owner tracking, each free triggers save_stack() which performs stack\nunwinding under RCU read lock.  Without yielding, this creates an\nunbounded RCU critical section.\n\nAdd periodic cond_resched() calls within the loop to allow:\n- RCU grace periods to complete\n- Other tasks to run\n- Scheduler to preempt when needed\n\nThe fix uses need_resched() for immediate response under load, with a\nbatch count of 32 as a guaranteed upper bound to prevent worst-case stalls\neven under light load.","modified":"2026-07-15T01:49:19.844949471Z","published":"2026-05-08T13:11:16.017Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43292.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1afe45f89d54b7183768ebbbbf14238ec187ab5c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2efa9c02c9b4c0d6866aa445f11056809b25ca28"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5747435e0fd474c24530ef1a6822f47e7d264b27"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b351fbe71091f7c8676c8ba597653d08b6719447"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43292.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43292"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"282631cb2447318e2a55b41a665dbe8571c46d70"},{"fixed":"2efa9c02c9b4c0d6866aa445f11056809b25ca28"},{"fixed":"1afe45f89d54b7183768ebbbbf14238ec187ab5c"},{"fixed":"b351fbe71091f7c8676c8ba597653d08b6719447"},{"fixed":"5747435e0fd474c24530ef1a6822f47e7d264b27"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43292.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.12.75"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43292.json"}}],"schema_version":"1.7.5"}