Linux Kernel CVE-2026-46017

Exploitation requires local code execution with at least low-privilege user access (PR:L per CVSS vector). The race is conditional on the kernel performing large-folio (transparent huge page) migration - either via automatic NUMA balancing (enabled by default on many distributions) or explicit page migration syscalls such as move_pages() or mbind(). The system must be multi-core (SMP) to allow concurrent execution of the migration path and the rmap-removal or deferred_split_scan() shrinker path; single-core systems cannot trigger the race. High attack complexity (AC:H) reflects the need to win a narrow timing window between two kernel execution paths. Systems where NUMA balancing is disabled, THP is set to never, or workloads do not create large compound pages are not practically exposed. This vulnerability does not enable remote exploitation, privilege escalation, data exfiltration, or lateral movement - impact is strictly limited to local kernel availability.

The CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a medium-low severity local availability issue. AV:L confirms that an attacker must already have local code execution on the host - remote exploitation is not possible. AC:H reflects the requirement to win a precise timing race between concurrent kernel paths, making reliable exploitation non-trivial. PR:L indicates a standard unprivileged user account suffices to trigger migration workloads. The EPSS score of 0.02% (5th percentile) is consistent with the AC:H rating and confirms extremely low observed or predicted exploitation probability. The CVE is not in CISA KEV, and no public POC or exploit code has been identified at time of analysis. The sole impact is availability (A:H), limited to kernel instability such as a triggered WARN or potential kernel panic - no confidentiality or integrity impact. Practical risk is highest on multi-core NUMA systems running workloads that heavily exercise transparent huge page migration (HPC clusters, large in-memory databases, virtualization hosts). Systems with NUMA balancing disabled or without THP-intensive workloads face negligible practical exposure despite the broad version range affected.

A local user with standard unprivileged access on a multi-core NUMA system spawns a memory-intensive workload that promotes anonymous memory to transparent huge pages and triggers NUMA balancing migration, while simultaneously another kernel thread performs rmap removal on the same destination folios. The precise race between migrate_folio_move() delaying the split_queue requeue and the concurrent rmap-removal path calling deferred_split_folio() causes a kernel WARN, potentially escalating to a kernel panic depending on kernel configuration. No public proof-of-concept exists; reliably winning the race requires either high-frequency migration workloads or deliberate timing, making casual exploitation difficult.