Look up another CVE · open CVE-2026-43258 in the interactive tracker

CVE-2026-43258

alpha: fix user-space corruption during memory compaction

7.8 EPSS 0.2% AV:L

Published 2026-05-06 (5 months ago) by the Linux kernel CNA. Subsystem arch/alpha. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-43258 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	fixed	6.12.85-1	Update the kernel and reboot. Fixed in 6.12.85-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	6.19.6-1	Update the kernel and reboot. Fixed in 6.19.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	6.19.6-1	Update the kernel and reboot. Fixed in 6.19.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned tcache chunk"), and compiler internal errors. The failures disappear when compaction is disabled or when using global TLB invalidation. The root cause is insufficient TLB shootdown during page migration. Alpha relies on ASN-based MM context rollover for instruction cache coherency, but this alone is not sufficient to prevent stale data or instruction translations from surviving migration. Fix this by introducing a migration-specific helper that combines: - MM context invalidation (ASN rollover), - immediate per-CPU TLB invalidation (TBI), - synchronous cross-CPU shootdown when required. The helper is used only by migration/compaction paths to avoid changing global TLB semantics. Additionally, update flush_tlb_other(), pte_clear(), to use READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. This fixes observed crashes on both UP and SMP Alpha systems.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

arch/alpha/include/asm/pgtable.h
arch/alpha/include/asm/tlbflush.h
arch/alpha/mm/Makefile
arch/alpha/mm/tlbflush.c

What this is: ALPHA PORTMAINTAINERS section matched on arch/alpha/ · linux-alpha@vger.kernel.org · Odd Fixes

Show whether Debian builds this, per release

Debian builds this code. Every release with an answer below compiles the affected file into the kernels it ships. The build rule could not be established for 1 release, so nothing is claimed about those.

bookworm?
trixie, forky, sidy

?: not established - no Makefile entry for the affected file
y: built into the kernel image on every flavour - only a patch removes it

Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-05-06 (5 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.18%, higher than 6.6% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: arch/alpha

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.16	6.12.75	d4ca6ca2c6f5
2.6.16	6.18.16	03e42b5f7ad4
2.6.16	6.19.6	bab8d762a8db
2.6.16	7.0	dd5712f3379c

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The vulnerable path is reached locally through memory migration/compaction, including page faults/high-order or THP allocation pressure and same-process migration interfaces, not through a network or physical interface.
AC:LAttack complexity, low: An unprivileged attacker can repeatedly create memory pressure and migratable mappings to drive compaction/migration; no uncontrollable race or victim timing is required for triggering the stale TLB condition.
PR:LPrivileges required, low: A basic local user can allocate memory, fault pages, use madvise/THP-related behavior, and migrate its own pages; privileged manual compact_memory access is not required.
UI:NUser interaction, none: Once the attacker has local execution, no separate victim action is needed to trigger compaction or access the stale mapping.
S:UScope, unchanged: The bug is in kernel memory-management enforcement for local processes and does not cross a separate security authority such as a hypervisor or sandbox boundary.
C:HConfidentiality impact, high: Stale user TLB entries can continue to reference a physical page after migration, allowing reads from a page after it is freed and potentially reallocated to page cache or another process.
I:HIntegrity impact, high: The same stale writable mapping can corrupt the reallocated physical page, making cross-process/page-cache corruption and code/data modification defensible.
A:HAvailability impact, high: The issue is documented to cause SIGSEGVs, glibc heap corruption, compiler crashes, and other repeated user-space corruption during compaction.