What’s Vulnerable › Vulnerabilities

CVE-2026-46171: riscv: kvm: fix vector context allocation leak

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-28 · updated 2026-10-21
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: kvm: fix vector context allocation leak When the second kzalloc (host_context.vector.datap) fails in kvm_riscv_vcpu_alloc_vector_context, the first allocation (guest_context.vector.datap) is leaked. Free it before returning.

Affected products

• Linux kernel: from 6.5 before 6.18.30; from 6.19 before 7.0.7 — fixed in 6.18.30, 7.0.7

How to fix

Upgrade to a fixed version: Linux kernel 6.18.30, 7.0.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1d57ab45ec5c0e22789de793bcf2a31ad6fb7d98
• https://git.kernel.org/stable/c/70ecebe7c58ce01f8da3f513eafb51bd147b1e63
• https://git.kernel.org/stable/c/8f3a5dc4055e1001b44ca8ae2bd3eb1d07782049
• https://git.kernel.org/stable/c/b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978
• https://git.kernel.org/stable/c/bd62c0f61bc722a097417401030c596cea8e21aa

Get alerted when CVE-2026-46171 or the next vulnerability affects your stack