CVE-2026-46035

In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP

On UP kernels (!CONFIG_SMP), spin_trylock() is a no-op that

unconditionally succeeds even when the lock is already held. As a

result, alloc_frozen_pages_nolock() called from NMI context can

re-enter rmqueue() and acquire the zone lock that the interrupted

context is already holding, corrupting the freelists.

With CONFIG_DEBUG_SPINLOCK on UP, the following BUG is triggered with

the slub_kunit test module:

BUG: spinlock trylock failure on UP on CPU#0, kunit_try_catch/243

[...]

Call Trace:

<NMI>

dump_stack_lvl+0x3f/0x60

do_raw_spin_trylock+0x41/0x50

_raw_spin_trylock+0x24/0x50

rmqueue.isra.0+0x2a9/0xa70

get_page_from_freelist+0xeb/0x450

alloc_frozen_pages_nolock_noprof+0x111/0x1e0

allocate_slab+0x42a/0x500

___slab_alloc+0xa7/0x4c0

kmalloc_nolock_noprof+0x164/0x310

[...]

</NMI>

Fix this by returning NULL early when invoked from NMI on a UP kernel.