Executive brief
A vulnerability in the Linux kernel's persistent storage (pstore) component could allow a local attacker to cause a system crash or potentially access sensitive memory. This component is responsible for saving kernel logs across reboots, typically for debugging system failures. While the conditions required to trigger this flaw are extremely rare and difficult to achieve in practice, an exploit could impact system stability or lead to unauthorized data access.
Technical details
A heap buffer overflow (out-of-bounds write) exists in the 'persistent_ram_save_old()' function within the pstore/ram driver (fs/pstore/ram_core.c). The vulnerability is caused by the function failing to reallocate 'prz->old_log' when the buffer size increases between calls, while still using the new, larger size for 'memcpy_fromio()' operations. This can occur if a non-fatal 'oops' happens after a reboot where a smaller log was initially allocated. An attacker with local access could potentially trigger this condition to cause a kernel panic or achieve out-of-bounds reads/writes. The fix involves explicitly freeing and reallocating the buffer if the new size differs from the previously allocated size.
Affected products
- Linux Linux Kernel All versions prior to the June 2026 patches
Timeline
- 2026-02-01: other: Patch submitted by researcher
- 2026-06-03: advisory: CVE-2026-46253 published
- 2026-06-03: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/06d2c8bd108cea503f6f6e13e47495ed1085275f
- https://git.kernel.org/stable/c/2fa9a047c6a50ec80c3890dd623b85e237f0d1fd
- https://git.kernel.org/stable/c/4f73486ca822305c1cf5b8ebc0b53a6ab3801a81
- https://git.kernel.org/stable/c/5669645c052f235726a85f443769b6fc02f66762
- https://git.kernel.org/stable/c/58bda5a1d1ee98254383ef34f76b2c35140513ea
- https://git.kernel.org/stable/c/7cfe964e61c0ab667abd5f5b68e0acbf783efa4f
- https://git.kernel.org/stable/c/9a6fc69a570c0780834246d52c856cc3dbc2605f