Executive brief
A vulnerability was found in the Linux kernel's memory management system. When the system attempts to resize a memory allocation to a smaller size while also moving it to a different memory node or alignment, it may accidentally write more data than the new space can hold. This could lead to system instability, crashes, or potentially allow an attacker to gain unauthorized control over the system.
Technical details
A buffer overflow exists in the Linux kernel's mm/vmalloc.c within the vrealloc_node_align() function. The vulnerability occurs when the 'need_realloc' path is triggered (e.g., due to NUMA node or alignment constraints) during a shrink operation (where the new size is smaller than the old size). The code incorrectly used the 'old_size' for a memcpy() operation into a newly allocated buffer of 'size' bytes, leading to an out-of-bounds write. This was introduced by commit 4c5d3365882d and has been fixed by ensuring the copy length is the minimum of the old and new sizes. An attacker with the ability to trigger vmalloc reallocations could potentially exploit this for local privilege escalation or denial of service.
Affected products
- Linux Linux Kernel Introduced in commit 4c5d3365882d; fixed in 82d1f01292d3, b281adf71f78, e9b057a44def
Timeline
- 2026-04-20: disclosed: Initial patch submitted by Marco Elver
- 2026-04-27: patched: Patch committed to mainline kernel
- 2026-06-08: advisory: CVE-2026-46281 published