CVE-2026-46171 is a vulnerability in the Linux kernel's RISC-V KVM subsystem where a failure in the second kzalloc call during vector context allocation leads to a memory leak of the first allocation. This issue was resolved by ensuring the first allocation is freed before returning on failure. The vulnerability has a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The fix is included in Linux kernel updates for multiple Ubuntu 26.04 LTS kernel packages.

The vulnerability causes a memory leak in the Linux kernel's RISC-V KVM subsystem, which can lead to denial of service by exhausting kernel memory resources. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and no user interaction. No known exploits are reported in the wild.

A patch is available and included in updated Linux kernel packages for Ubuntu 26.04 LTS. Users should apply the kernel updates to the specified fixed versions and reboot their systems to ensure the vulnerability is remediated. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor advisory instructions for updating to the fixed package versions.