CVE-2026-46093 addresses a concurrency issue in the Linux kernel's vmalloc subsystem. The function decay_va_pool_node() can be called concurrently from __purge_vmap_area_lazy() during pool purging and from the shrinker via vmap_node_shrink_scan(). Since decay_va_pool_node() is not safe for concurrent execution and the shrinker path lacked serialization, this led to race conditions and possible memory leaks. The vulnerability is mitigated by acquiring the vmap_purge_lock in the shrinker path to serialize access and prevent races.

The vulnerability allows concurrent execution of a non-thread-safe function, causing race conditions that can lead to memory leaks and potentially compromise system stability or security. The CVSS vector indicates high impact on confidentiality, integrity, and availability, meaning exploitation could result in significant system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix involves taking the vmap_purge_lock in the shrinker path to ensure serialization. Users should monitor official Linux kernel advisories for patches addressing CVE-2026-46093 and apply them promptly once available.