CVE-2026-46093 is a race condition vulnerability in the Linux kernel's memory management vmalloc subsystem. The function decay_va_pool_node() can be invoked concurrently from two different paths (__purge_vmap_area_lazy() and the shrinker via vmap_node_shrink_scan()) without proper locking, as the shrinker path lacks serialization. This leads to race conditions and possible memory leaks. The vulnerability affects linux-hwe-edge kernel versions prior to 7.0.0-27.27, 7.0.0-1008.8, 7.0.0-1009.9, 7.0.0-1010.10, and 7.0.0-28.28~24.04.1. Ubuntu has released patched kernel versions to address this issue. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability.

The vulnerability allows local attackers with limited privileges to exploit a race condition in the kernel memory management subsystem, potentially causing memory leaks and compromising system stability and security. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability, meaning sensitive information could be exposed or system behavior altered. No known exploits in the wild have been reported at this time.

A patch is available and has been released by Ubuntu as part of updated Linux kernel packages. Users should apply the standard system update and reboot their systems to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor advisory instructions for updating to the fixed package versions corresponding to your Ubuntu release and kernel flavor.