CVE-2026-46171: Linux RISC-V KVM Vector Context Memory Leak

Technical summary

CVE-2026-46171 is a memory leak vulnerability in kvm_riscv_vcpu_alloc_vector_context within the Linux kernel's RISC-V KVM module. The vulnerability is triggered when the host_context.vector.datap kzalloc call fails after a successful guest_context.vector.datap allocation. The error path does not release the guest context allocation before returning, violating proper resource cleanup patterns. This is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), affecting RISC-V systems running KVM-enabled kernels.

Business impact

On affected systems, repeated virtual machine creation or memory allocation failures could gradually consume kernel memory, eventually causing the hypervisor to become unresponsive or crash. For organizations running RISC-V-based cloud platforms, embedded virtualization, or research systems using KVM, this can lead to service disruptions and denial of service. The impact is greatest in environments where VMs are frequently created and destroyed or where memory is already constrained.

Affected systems

This vulnerability affects Linux kernel installations on RISC-V architectures with KVM support enabled. RISC-V is an open-source instruction set used in embedded systems, research platforms, and emerging server deployments. Standard x86 and ARM systems are not affected. Affected deployments include RISC-V-based hypervisors, research computing clusters using RISC-V KVM, and any RISC-V system hosting multiple virtual machines.

Exploitability

Exploitation requires local system access (AV:L) and Linux user privileges (PR:L) to trigger VM creation operations. An attacker cannot remotely exploit this vulnerability. The attack does not require user interaction and affects the availability of system resources. Exploitation is straightforward—repeatedly creating and destroying virtual machines or triggering vector context allocation failures will gradually leak memory. However, the impact manifests over time rather than through immediate critical damage.

Remediation

Apply the kernel patch that adds proper memory deallocation in the error path of kvm_riscv_vcpu_alloc_vector_context. The fix ensures that guest_context.vector.datap is freed if host_context.vector.datap allocation fails. Verify the patch is included in your kernel version by consulting vendor advisories or kernel release notes. Systems already running patched kernels derived from upstream kernel fixes (post-June 2026) should be protected.

Patch guidance

Check your kernel version against vendor advisories for the specific RISC-V KVM memory leak fix. Upstream Linux kernel patches addressing this issue should be available in stable release branches. For distributions (e.g., Linux distributions supporting RISC-V), monitor security bulletins and apply kernel updates when available. Rebuild or update the kernel, test VM creation in non-production environments first, and schedule production updates during maintenance windows. Verify the fix by confirming the error path cleanup code is present in your kernel source.

Detection guidance

Monitor kernel memory usage on RISC-V systems running KVM, particularly non-reclaimable kernel memory (/proc/meminfo MemAvailable and Slab metrics). Sustained memory growth during VM lifecycle operations (creation/deletion) may indicate the leak. Enable KVM event tracing to correlate memory pressure with vcpu_alloc failures. Log kernel allocation errors (dmesg) for kvm_riscv_vcpu_alloc_vector_context failures. Alert on abnormal kernel memory exhaustion patterns that precede system hangs.

Why prioritize this

Although the CVSS score is moderate (5.5), this vulnerability merits prompt patching because it affects system stability and can cascade across virtualized infrastructure. RISC-V KVM deployments, while currently smaller than x86 or ARM, are growing in research and embedded markets. The simplicity of triggering the leak and the potential for compound effects in multi-tenant environments justify treating this as medium-high priority for affected operators.

Risk score, explained

The CVSS:3.1 score of 5.5 (MEDIUM) reflects local attack vector, low privileges required, and high availability impact (denial of service through resource exhaustion). The score does not account for the incremental nature of the leak or ecosystem-specific concentration in emerging RISC-V platforms. Organizations with heavy RISC-V KVM workloads should treat this as more critical than the base score suggests.

Frequently asked questions