CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker

Synopsis

A race condition in the Linux kernel's virtual memory allocator (mm/vmalloc) allows a local attacker with a low-privilege account to exploit concurrent execution paths in the vmap shrinker, leading to memory corruption or leaks. The vulnerability is reachable locally and requires no special privileges beyond a standard user account. Successful exploitation gives the attacker full read, write, and availability impact over the affected system, enabling data disclosure, data tampering, and service disruption. Patched-image rebuilds at fix versions 6.18.27 and 7.0.4 are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the race condition; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerable code path independently.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is obtained; no race-window timing beyond what the kernel shrinker naturally produces is required of the attacker.

Blast Radius

• A successful attacker can read arbitrary kernel memory, exposing credentials, session tokens, or other sensitive data held in kernel structures.
• The attacker can corrupt or modify kernel memory, altering persistent data structures or injecting malicious content into kernel-managed buffers.
• The race condition can trigger a kernel panic or unrecoverable memory leak, crashing the affected host and taking down all workloads running on it.
• All three impacts (read, write, crash) are available from a single low-privilege local account without any additional preconditions.