CVE-2026-43258

What it actually does

This is a Linux kernel memory-management flaw affecting Alpha architecture systems. During memory compaction and page migration, insufficient TLB shootdown can leave stale data or instruction translations active after pages move. A local user process can potentially experience or influence memory corruption, stale mappings, process crashes, or incorrect execution. Because the corruption occurs in kernel-managed address translation state, the theoretical impact includes compromise of confidentiality, integrity, and availability, although public exploit maturity is currently reported as none and EPSS is low.

Why it matters to the business

Organizations running Linux on Alpha systems may experience unexplained application crashes, heap corruption, compiler failures, or system instability, especially under memory pressure or where memory compaction is used. In the worst case, a local attacker with access to the system could attempt to turn the memory corruption into privilege escalation or data compromise. The issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, and currently has low exploitation probability, but it should still be remediated on affected systems because kernel memory-corruption flaws can be severe when practical exploitation becomes available.

How an attack unfolds

An attacker first needs local code execution on an affected Linux Alpha system. They then create memory pressure and fragmentation, or otherwise cause memory compaction and page migration to occur. During page migration, the vulnerable kernel paths may fail to invalidate stale TLB entries across the necessary CPUs and contexts. The attacker attempts to keep using stale translations after migration, causing reads, writes, or instruction fetches to reference unintended physical pages. In a reliable exploit, this primitive could be shaped into corruption of sensitive process or kernel-adjacent state, potentially leading to privilege escalation, data exposure, or denial of service. In practice, the vulnerability has primarily been described as sporadic user-space crashes and heap corruption, and no mature public exploit is known from the supplied data.

How to fix it

Upgrade to a Linux kernel build that includes the Alpha memory compaction TLB shootdown fix for this issue. If using a distribution kernel, install the vendor-provided security update for the affected kernel package and reboot into the updated kernel. No exact fixed package versions were provided in the input, so remediation should be validated against distribution advisories or upstream kernel commits containing the fix described as "alpha: fix user-space corruption during memory compaction." As temporary risk reduction on affected Alpha systems, reduce or disable proactive memory compaction where operationally acceptable, avoid manual compaction triggers, and consider disabling features that increase compaction pressure such as transparent huge pages if they are not required. These mitigations reduce triggerability but do not replace a kernel update.

How to confirm the fix worked

Confirm whether the system is actually affected by verifying it is running the Alpha architecture and a vulnerable kernel lineage. Validate remediation by confirming the running kernel version after reboot matches a vendor release that includes the Alpha memory-compaction TLB shootdown fix. Review kernel package changelogs or source patches for the relevant fix text, including migration-specific TLB invalidation, ASN/MM context invalidation, per-CPU TBI, and synchronous cross-CPU shootdown changes. Confirm that temporary mitigations, if used, are active by checking memory compaction and transparent huge page settings. Operationally, run controlled memory-pressure and compaction regression testing on patched Alpha systems and confirm that prior symptoms such as SIGSEGV, glibc allocator corruption messages, and compiler internal errors no longer recur.

Typical attack path

1. Gain local execution as an unprivileged user on an affected Linux Alpha system.
2. Generate memory pressure and fragmentation to increase the likelihood of kernel memory compaction and page migration.
3. Trigger or wait for compaction activity, such as kcompactd activity or manual compaction paths.
4. Exercise user-space memory mappings during migration so stale TLB entries may survive page movement.
5. Use the resulting stale translation behavior to cause process memory corruption, crashes, or potentially controlled corruption.
6. Attempt to convert controlled corruption into privilege escalation, data access, or denial of service.

How to detect it

There are no reliable network indicators for this local kernel memory-management flaw. Detection should focus on host telemetry from affected Linux Alpha systems. Review journal, syslog, kernel logs, audit logs, shell history, and core-dump metadata for bursts of unexplained SIGSEGV events, glibc heap-corruption messages, compiler internal errors, or process crashes that correlate with memory pressure, kcompactd activity, transparent huge page allocation, or manual writes to /proc/sys/vm/compact_memory. Look for local users or workloads intentionally generating high memory pressure, repeated compaction triggers, or stress-style allocation patterns before crashes. Because the described symptoms can also occur from benign hardware or software faults, treat these as suspicious behavioral indicators rather than definitive proof of exploitation. Preserve core files and memory-pressure telemetry for forensic comparison before and after patching.

• unaligned tcache chunk
• malloc_printerr
• SIGSEGV
• Segmentation fault
• internal compiler error
• kcompactd
• /proc/sys/vm/compact_memory
• compact_memory
• vm.compaction_proactiveness
• transparent_hugepage
• echo 1 > /proc/sys/vm/compact_memory

What your security team should do

• Inventory Linux systems by architecture and prioritize any Alpha systems running kernels without the memory-compaction TLB shootdown fix.
• Apply the appropriate vendor kernel update and reboot affected systems into the patched kernel.
• If immediate patching is not possible, reduce proactive memory compaction and avoid manual compaction on affected Alpha systems until maintenance can be completed.
• Monitor affected hosts for unexplained SIGSEGV events, glibc allocator corruption messages, compiler internal errors, and crash bursts correlated with memory pressure or compaction activity.
• Treat this as lower external-exploitation urgency because it requires local access, is not in KEV, is not known ransomware-used, and has low EPSS, but do not defer indefinitely because kernel memory-corruption bugs can become privilege-escalation paths.
• Restrict local shell access and workload execution on affected systems to trusted users until patched.
• Preserve crash dumps, kernel logs, shell history, and audit logs if exploitation or abnormal crash patterns are suspected.