Skip to main content

Linux Kernel EUVD-2026-27817

| CVE-2026-43258 HIGH
Out-of-bounds Write (CWE-787)
2026-05-06 Linux GHSA-rj9j-qfgp-687w
7.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 08, 2026 - 13:44 vuln.today
CVSS changed
May 08, 2026 - 13:22 NVD
7.8 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

alpha: fix user-space corruption during memory compaction

Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled.

Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned tcache chunk"), and compiler internal errors. The failures disappear when compaction is disabled or when using global TLB invalidation.

The root cause is insufficient TLB shootdown during page migration. Alpha relies on ASN-based MM context rollover for instruction cache coherency, but this alone is not sufficient to prevent stale data or instruction translations from surviving migration.

Fix this by introducing a migration-specific helper that combines:

  • MM context invalidation (ASN rollover),
  • immediate per-CPU TLB invalidation (TBI),
  • synchronous cross-CPU shootdown when required.

The helper is used only by migration/compaction paths to avoid changing global TLB semantics.

Additionally, update flush_tlb_other(), pte_clear(), to use READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering.

This fixes observed crashes on both UP and SMP Alpha systems.

AnalysisAI

Local privilege escalation and memory corruption in Linux kernel on Alpha architecture allows authenticated users to execute arbitrary code, corrupt heap memory, or crash systems via insufficient TLB shootdown during memory compaction. The vulnerability affects Alpha systems exclusively and manifests as SIGSEGV crashes, glibc allocator corruption, and compiler failures. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify all Alpha architecture Linux systems in production and map kernel versions against affected branches. Within 7 days: Apply vendor-released kernel patches to all Alpha systems across stable branches (verify specific version numbers from kernel.org or distribution advisories). …

Sign in for detailed remediation steps.

Vendor StatusVendor

Share

EUVD-2026-27817 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy