Executive brief
A vulnerability was identified in the Linux kernel's memory management system (SLUB allocator). This flaw can lead to data loss or a system crash when the kernel attempts to resize memory buffers, particularly when moving data between different CPU nodes or adjusting memory alignment. An exploit could potentially allow a local attacker to cause a denial-of-service or corrupt sensitive kernel data.
Technical details
The vulnerability exists in the SLUB allocator's __do_krealloc and kvrealloc paths. Two distinct issues were identified: (1) a logic error where a jump to the 'alloc_new' label occurred before the original buffer size was initialized, resulting in a 0-byte memcpy (data loss) during NUMA migration; and (2) a buffer overflow where memcpy used the larger original size instead of the smaller new size when shrinking an object with forced alignment. These issues were introduced by the feature allowing forced reallocation for alignment/node requirements even during shrinking. Attackers with the ability to trigger these memory reallocation paths could cause out-of-bounds writes. The fix involves moving size calculations to the start of the function and bounding all copy operations by the new allocation size.
Affected products
- Linux Linux kernel Introduced in commit 2cd8231796b5; fixed in 6.1.x, 6.6.x, and mainline
Timeline
- 2026-04-16: patched: Initial fix authored by Marco Elver
- 2026-05-27: advisory: CVE-2026-45990 published via NVD/kernel.org