HIGH
alpha TLB Race
CVE-2026-43258
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned tcache chunk"), and compiler internal errors. The failures disappear when compaction is disabled or when using global TLB invalidation. The root cause is insufficient TLB shootdown during page migration. Alpha relies on ASN-based MM context rollover for instruction cache coherency, but this alone is not sufficient to prevent stale data or instruction translations from surviving migration. Fix this by introducing a migration-specific helper that combines: - MM context invalidation (ASN rollover), - immediate per-CPU TLB invalidation (TBI), - synchronous cross-CPU shootdown when required. The helper is used only by migration/compaction paths to avoid changing global TLB semantics. Additionally, update flush_tlb_other(), pte_clear(), to use READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. This fixes observed crashes on both UP and SMP Alpha systems.
02KernelScan AI Analysis
Risk summary
Alpha systems experience sporadic user-space crashes and heap corruption during memory compaction due to insufficient TLB shootdown. Any local unprivileged process can trigger memory allocation patterns that lead to compaction, causing stale TLB entries to survive page migration. This results in SIGSEGV crashes, allocator failures, and potential memory corruption affecting arbitrary user processes.
Vulnerability analysis
The root cause is a race condition in Alpha's TLB management during page migration. The kernel fails to perform immediate per-CPU TLB invalidation and synchronous cross-CPU shootdown when compacting or migrating pages, allowing stale data or instruction translations to persist. The fix introduces a migration-specific helper (migrate_flush_tlb_page) that combines MM context invalidation (ASN rollover), immediate TLB invalidation, and synchronous cross-CPU shootdown, along with proper SMP memory ordering via READ_ONCE()/WRITE_ONCE() in flush_tlb_other() and pte_clear().
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.75 | d4ca6ca2c6f5 |
| 6.18 | 6.18.16 | 03e42b5f7ad4 |
| 6.19 | 6.19.6 | bab8d762a8db |
| mainline | 7.0 | dd5712f3379c |