Linux Kernel CVE-2026-43258

Exploitation requires local authenticated access (PR:L) to an Alpha architecture Linux system running an unpatched kernel version. The vulnerability is triggered when memory compaction is enabled (default configuration in most modern kernels) and active page migration occurs, either through natural memory pressure or manual invocation via /proc/sys/vm/compact_memory. The issue is specific to Alpha CPU architecture's ASN-based memory management and does not affect x86, ARM, RISC-V, or other architectures. Both uniprocessor (UP) and symmetric multiprocessing (SMP) Alpha configurations are vulnerable. Limiting factor: the extreme rarity of Alpha hardware in production deployments significantly reduces real-world exploitation surface despite low attack complexity once prerequisites are met.

Real-world risk is highly architecture-specific and limited in scope. CVSS 7.8 HIGH score reflects maximum potential impact (complete system compromise) but requires local authenticated access (PR:L) on Alpha hardware, which represents a negligible fraction of modern deployments. EPSS score of 0.02% (5th percentile) correctly indicates extremely low probability of exploitation in the wild, as Alpha systems are legacy hardware rarely deployed in production environments. The attack complexity is low (AC:L) once an attacker has local access, but the prerequisite of Alpha architecture creates a natural barrier to widespread exploitation. No CISA KEV listing exists, confirming absence of active exploitation campaigns. While the technical impact is severe (memory corruption, arbitrary code execution potential), the practical risk is minimal for organizations running x86, ARM, or other modern architectures. Priority should be LOW for most organizations unless actively maintaining legacy Alpha systems in critical roles. The availability of vendor patches across multiple stable branches (6.12.75, 6.18.16, 6.19.6, 7.0) indicates mature remediation options. Organizations with Alpha systems should prioritize patching to eliminate potential privilege escalation vectors, but this CVE does not represent an urgent threat to the broader Linux ecosystem.

An authenticated local user on an Alpha-based Linux system triggers memory compaction through normal system operations (large allocations, memory pressure) or deliberately via /proc/sys/vm/compact_memory. During page migration, stale TLB entries allow the attacker's process to access old physical memory locations now mapped to other processes or kernel structures. The attacker crafts heap operations to exploit this temporal memory aliasing, corrupting allocator metadata or overwriting sensitive data structures, leading to arbitrary code execution with the privileges of the targeted process or kernel panic for denial of service. Public exploit code availability is not confirmed at time of analysis.