LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46035: mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP On UP kernels (!CONFIG_SMP), spin_trylock() is a no-op that unconditionally succeeds even when the lock is already held. As a result, alloc_frozen_pages_nolock() called from NMI context can re-enter rmqueue() and acquire the zone lock that the interrupted context is already holding, corrupting the freelists. With CONFIG_DEBUG_SPINLOCK on UP, the following BUG is triggered with the slub_kunit test module: BUG: spinlock trylock failure on UP on CPU#0, kunit_try_catch/243 [...] Call Trace: <NMI> dump_stack_lvl+0x3f/0x60 do_raw_spin_trylock+0x41/0x50 _raw_spin_trylock+0x24/0x50 rmqueue.isra.0+0x2a9/0xa70 get_page_from_freelist+0xeb/0x450 alloc_frozen_pages_nolock_noprof+0x111/0x1e0 allocate_slab+0x42a/0x500 ___slab_alloc+0xa7/0x4c0 kmalloc_nolock_noprof+0x164/0x310 [...] </NMI> Fix this by returning NULL early when invoked from NMI on a UP kernel.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects single-processor builds where a kernel memory allocation path can wrongly re-enter a locked allocator during a non-maskable interrupt. The result is allocator freelist corruption, which can crash or destabilize the system. The source bundle does not show active exploitation or a CVSS score.

Executive priority

Prioritize for systems using custom or embedded single-processor Linux kernels. For mainstream SMP server fleets, treat as targeted follow-up unless vendor advisories identify affected packages. The main business risk is kernel instability or memory corruption, not confirmed active exploitation.

Technical view

On !CONFIG_SMP kernels, spin_trylock() always succeeds. If alloc_frozen_pages_nolock() runs from NMI context while the interrupted path holds the zone lock, it can re-enter rmqueue() and corrupt page allocator freelists. The fix returns NULL early when called from NMI on UP kernels.

Likely exposure

Exposure appears limited to Linux kernels built without CONFIG_SMP, especially custom, embedded, lab, or constrained single-CPU deployments. Standard multi-processor server distributions are less likely exposed unless they ship or run UP kernel configurations. The affected version data in the provided bundle is incomplete and should be checked against vendor kernel packages.

Exploitation context

The bundle does not cite KEV listing, active exploitation, public exploit code, or remote attack evidence. The described trigger is a kernel internal NMI allocation path, with a BUG observed under CONFIG_DEBUG_SPINLOCK using the slub_kunit test module.

Researcher notes

Key exposure hinge is !CONFIG_SMP behavior: spin_trylock is ineffective on UP, allowing allocator lock re-entry from NMI. The public record gives no CVSS, CWE, exploitability analysis, or distro-specific affected ranges, so validation should focus on kernel config and exact patch lineage.

Mitigation direction

  • Update to a kernel containing one of the referenced stable fixes.
  • Check distribution advisories before assuming upstream commit coverage.
  • Avoid affected !CONFIG_SMP kernel builds where operationally possible.
  • For custom kernels, rebuild with the upstream fix applied.
  • Track vendor guidance if using embedded or appliance kernels.

Validation and detection

  • Confirm whether running kernels are built with CONFIG_SMP disabled.
  • Map deployed kernel source or package version to the referenced stable commits.
  • Review vendor changelogs for CVE-2026-46035 or the page_alloc NMI fix.
  • Regression-test patched UP kernels in a controlled environment.
  • Monitor kernel logs for allocator, spinlock, or freelist corruption warnings.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46035 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd7242af8643409aae32243450341ef25b28d8a8c, d7242af8643409aae32243450341ef25b28d8a8c, d7242af8643409aae32243450341ef25b28d8a8cunaffected
LinuxLinux6.18, 0, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.