Linux Kernel CVE-2026-46318

Exploitation requires local system access with at least standard user-level privileges (PR:L per CVSS vector). The target system must have hugetlbfs in active use - this is a non-default configuration present only when huge pages have been explicitly enabled via kernel parameters (e.g., hugepages=N) and applications are using MAP_HUGETLB or mounting /dev/hugepages. The vulnerability is triggered specifically during mmap operations on hugetlb-backed regions when a VMA lock allocation fails partway through the mmap_prepare hook. Limiting factors: remote exploitation is not possible (AV:L); standard workstation and general-purpose server configurations without huge pages configured are not affected; the kernel community identified this as an internal regression with no known external discovery or exploitation.

Real-world risk is low. The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly reflects that exploitation requires local system access with at least standard user-level privileges - no remote attack path exists. EPSS at 0.02% (5th percentile) corroborates the low exploitation interest. The CVE is not listed in CISA KEV and no public exploit or proof-of-concept code has been identified. The 'Information Disclosure' tag applied in the source intelligence conflicts directly with the CVSS C:N metric (no confidentiality impact); this appears to be a tagging error and should not factor into disclosure-related risk decisions. The vulnerability is constrained to environments actively using hugetlbfs, which is non-default and primarily present in specialized workloads. The net assessment is a low-priority, internally-discovered kernel regression with patch already available, carrying negligible exploitation risk for most environments.

A local user with standard operating system privileges on a server running an affected kernel version - such as a database server using hugepages for shared memory - repeatedly invokes mmap operations against hugetlb-backed files in a way that induces allocation failures at the mmap_prepare stage. Each such failure leaks a VMA lock, incrementally exhausting kernel memory resources. Over time this may degrade system stability or trigger out-of-memory conditions, resulting in a local denial of service. No public exploit code exists and the attack requires local access, substantially limiting the threat model.