CVE-2026-43258

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43258", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.997Z", "datePublished": "2026-05-06T11:28:46.536Z", "dateUpdated": "2026-10-30T12:25:20.904Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:25:20.904Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nalpha: fix user-space corruption during memory compaction\n\nAlpha systems can suffer sporadic user-space crashes and heap\ncorruption when memory compaction is enabled.\n\nSymptoms include SIGSEGV, glibc allocator failures (e.g. \"unaligned\ntcache chunk\"), and compiler internal errors. The failures disappear\nwhen compaction is disabled or when using global TLB invalidation.\n\nThe root cause is insufficient TLB shootdown during page migration.\nAlpha relies on ASN-based MM context rollover for instruction cache\ncoherency, but this alone is not sufficient to prevent stale data or\ninstruction translations from surviving migration.\n\nFix this by introducing a migration-specific helper that combines:\n - MM context invalidation (ASN rollover),\n - immediate per-CPU TLB invalidation (TBI),\n - synchronous cross-CPU shootdown when required.\n\nThe helper is used only by migration/compaction paths to avoid changing\nglobal TLB semantics.\n\nAdditionally, update flush_tlb_other(), pte_clear(), to use\nREAD_ONCE()/WRITE_ONCE() for correct SMP memory ordering.\n\nThis fixes observed crashes on both UP and SMP Alpha systems."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached locally through memory migration/compaction, including page faults/high-order or THP allocation pressure and same-process migration interfaces, not through a network or physical interface.\nAC:L - An unprivileged attacker can repeatedly create memory pressure and migratable mappings to drive compaction/migration; no uncontrollable race or victim timing is required for triggering the stale TLB condition.\nPR:L - A basic local user can allocate memory, fault pages, use madvise/THP-related behavior, and migrate its own pages; privileged manual compact_memory access is not required.\nUI:N - Once the attacker has local execution, no separate victim action is needed to trigger compaction or access the stale mapping.\nS:U - The bug is in kernel memory-management enforcement for local processes and does not cross a separate security authority such as a hypervisor or sandbox boundary.\nC:H - Stale user TLB entries can continue to reference a physical page after migration, allowing reads from a page after it is freed and potentially reallocated to page cache or another process.\nI:H - The same stale writable mapping can corrupt the reallocated physical page, making cross-process/page-cache corruption and code/data modification defensible.\nA:H - The issue is documented to cause SIGSEGVs, glibc heap corruption, compiler crashes, and other repeated user-space corruption during compaction."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/alpha/include/asm/pgtable.h", "arch/alpha/include/asm/tlbflush.h", "arch/alpha/mm/Makefile", "arch/alpha/mm/tlbflush.c"], "versions": [{"version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "01cddfc34bf2a813a2773f1d607305515be55409", "status": "affected", "versionType": "git"}, {"version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "5593c9b255ae73f57a8b5e696a660032acbd67da", "status": "affected", "versionType": "git"}, {"version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6", "status": "affected", "versionType": "git"}, {"version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f", "status": "affected", "versionType": "git"}, {"version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "bab8d762a8dbb816b10011e13b87d1bca91e5f77", "status": "affected", "versionType": "git"}, {"version": "a48d07afdf18212de22b959715b16793c5a6e57a", "lessThan": "dd5712f3379cfe760267cdd28ff957d9ab4e51c7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/alpha/include/asm/pgtable.h", "arch/alpha/include/asm/tlbflush.h", "arch/alpha/mm/Makefile", "arch/alpha/mm/tlbflush.c"], "versions": [{"version": "2.6.16", "status": "affected"}, {"version": "0", "lessThan": "2.6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/01cddfc34bf2a813a2773f1d607305515be55409"}, {"url": "https://git.kernel.org/stable/c/5593c9b255ae73f57a8b5e696a660032acbd67da"}, {"url": "https://git.kernel.org/stable/c/d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6"}, {"url": "https://git.kernel.org/stable/c/03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f"}, {"url": "https://git.kernel.org/stable/c/bab8d762a8dbb816b10011e13b87d1bca91e5f77"}, {"url": "https://git.kernel.org/stable/c/dd5712f3379cfe760267cdd28ff957d9ab4e51c7"}], "title": "alpha: fix user-space corruption during memory compaction", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/alpha/include/asm/pgtable.h", "arch/alpha/include/asm/tlbflush.h", "arch/alpha/mm/Makefile", "arch/alpha/mm/tlbflush.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "01cddfc34bf2a813a2773f1d607305515be55409", "status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "versionType": "git"}, {"lessThan": "5593c9b255ae73f57a8b5e696a660032acbd67da", "status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "versionType": "git"}, {"lessThan": "d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6", "status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "versionType": "git"}, {"lessThan": "03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f", "status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "versionType": "git"}, {"lessThan": "bab8d762a8dbb816b10011e13b87d1bca91e5f77", "status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "versionType": "git"}, {"lessThan": "dd5712f3379cfe760267cdd28ff957d9ab4e51c7", "status": "affected", "version": "a48d07afdf18212de22b959715b16793c5a6e57a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/alpha/include/asm/pgtable.h", "arch/alpha/include/asm/tlbflush.h", "arch/alpha/mm/Makefile", "arch/alpha/mm/tlbflush.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"lessThan": "2.6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B61C2D7F-08C5-489E-8C29-2AFB211FF84B", "versionEndExcluding": "6.12.75", "versionStartIncluding": "2.6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:-:*:*:*:*:*:*", "matchCriteriaId": "EBF2513D-8F4F-4ED5-ADCE-9933F34F1BFB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "CC3639E1-B5E4-4DD6-80D4-BA07D192C42D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "54393D69-B368-4296-9798-D81570495C6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "6791A801-9E06-47DD-912F-D8594E2F6B3F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "AE90CCED-3A5B-46E3-A6B0-4865AB786289", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc6:*:*:*:*:*:*", "matchCriteriaId": "CBFF6DE7-6D7C-469A-9B2D-2F6E915F55B0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc7:*:*:*:*:*:*", "matchCriteriaId": "D0CD4E4B-E756-4401-A352-871EBA5B8680", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nalpha: fix user-space corruption during memory compaction\n\nAlpha systems can suffer sporadic user-space crashes and heap\ncorruption when memory compaction is enabled.\n\nSymptoms include SIGSEGV, glibc allocator failures (e.g. \"unaligned\ntcache chunk\"), and compiler internal errors. The failures disappear\nwhen compaction is disabled or when using global TLB invalidation.\n\nThe root cause is insufficient TLB shootdown during page migration.\nAlpha relies on ASN-based MM context rollover for instruction cache\ncoherency, but this alone is not sufficient to prevent stale data or\ninstruction translations from surviving migration.\n\nFix this by introducing a migration-specific helper that combines:\n - MM context invalidation (ASN rollover),\n - immediate per-CPU TLB invalidation (TBI),\n - synchronous cross-CPU shootdown when required.\n\nThe helper is used only by migration/compaction paths to avoid changing\nglobal TLB semantics.\n\nAdditionally, update flush_tlb_other(), pte_clear(), to use\nREAD_ONCE()/WRITE_ONCE() for correct SMP memory ordering.\n\nThis fixes observed crashes on both UP and SMP Alpha systems."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nalpha: soluciona la corrupci\u00f3n del espacio de usuario durante la compactaci\u00f3n de memoria\n\nLos sistemas Alpha pueden sufrir fallos espor\u00e1dicos del espacio de usuario y corrupci\u00f3n del heap cuando la compactaci\u00f3n de memoria est\u00e1 habilitada.\n\nLos s\u00edntomas incluyen SIGSEGV, fallos del asignador de glibc (p. ej., \u2019fragmento de tcache no alineado\u2019), y errores internos del compilador. Los fallos desaparecen cuando la compactaci\u00f3n est\u00e1 deshabilitada o cuando se utiliza la invalidaci\u00f3n global de la TLB.\n\nLa causa ra\u00edz es un TLB shootdown insuficiente durante la migraci\u00f3n de p\u00e1ginas. Alpha se basa en el rollover de contexto MM basado en ASN para la coherencia de la cach\u00e9 de instrucciones, pero esto por s\u00ed solo no es suficiente para evitar que datos obsoletos o traducciones de instrucciones sobrevivan a la migraci\u00f3n.\n\nEsto se soluciona introduciendo un ayudante espec\u00edfico para la migraci\u00f3n que combina:\n - invalidaci\u00f3n del contexto MM (rollover de ASN),\n - invalidaci\u00f3n inmediata de la TLB por CPU (TBI),\n - shootdown s\u00edncrono entre CPUs cuando sea necesario.\n\nEl ayudante se utiliza solo por rutas de migraci\u00f3n/compactaci\u00f3n para evitar cambiar la sem\u00e1ntica global de la TLB.\n\nAdem\u00e1s, se actualiza flush_tlb_other(), pte_clear(), para usar READ_ONCE()/WRITE_ONCE() para una correcta ordenaci\u00f3n de memoria SMP.\n\nEsto soluciona los fallos observados tanto en sistemas Alpha UP como SMP."}], "id": "CVE-2026-43258", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-06T12:16:46.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/01cddfc34bf2a813a2773f1d607305515be55409"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5593c9b255ae73f57a8b5e696a660032acbd67da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bab8d762a8dbb816b10011e13b87d1bca91e5f77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd5712f3379cfe760267cdd28ff957d9ab4e51c7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: alpha: fix user-space corruption during memory compaction", "id": "2467146", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467146"}, "csaw": false, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel, specifically affecting Alpha systems when memory compaction is enabled. Insufficient Translation Lookaside Buffer (TLB) shootdown during page migration can lead to sporadic user-space crashes and heap corruption. This vulnerability can result in application failures, including segmentation faults (SIGSEGV) and issues with memory allocation."], "name": "CVE-2026-43258", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43258\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43258\nhttps://lore.kernel.org/linux-cve-announce/2026050606-CVE-2026-43258-a9be@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d4ca6ca2c6f5a1d19d9014c5b36d96637846b5d6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,03e42b5f7ad4c2c3db8bd384bab7990d5d53c90f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bab8d762a8dbb816b10011e13b87d1bca91e5f77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dd5712f3379cfe760267cdd28ff957d9ab4e51c7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:45:07.231419+00:00", "updated": "2026-05-11T19:45:08.828132+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}