Executive brief
A vulnerability in the Linux kernel's module decompression component could allow a local attacker to cause a system crash (kernel oops). This occurs when the system fails to allocate memory during the loading of a compressed kernel module, leading to an improper memory access. While this primarily impacts system availability, it could disrupt operations or be used as part of a larger attack chain.
Technical details
A vulnerability exists in 'kernel/module/decompress.c' where the return value of 'module_extend_max_pages()' is not checked. This function internally calls 'kvrealloc()'; if the initial allocation fails, 'info->pages' remains NULL. Subsequent calls to 'module_get_next_page()' attempt to grow the array by calling 'module_extend_max_pages(info, 0)', causing 'kvrealloc(NULL, 0)' to return 'ZERO_SIZE_PTR'. The kernel then treats this as a success and attempts to dereference 'ZERO_SIZE_PTR', resulting in a kernel oops. The fix involves adding an explicit error check to ensure the module loading path returns immediately upon allocation failure.
Affected products
- Linux Linux Kernel 5.17 to 6.1.178, 6.6.145, 6.12.96
Timeline
- 2026-05-18: other: Patch authored by Andrii Kuchmenko
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/168072baf9ad516d5a06046514c7fea4c0671990
- https://git.kernel.org/stable/c/786d2d84416a9a1c1a47b71a68d679d886284be2
- https://git.kernel.org/stable/c/a82e170637e050a803b4f37542371ef216bf66d2
- https://git.kernel.org/stable/c/afcc0515bbdd28d509a2b5870faaa89b137f5d53
- https://git.kernel.org/stable/c/e7da02659c229f73492fb1ed87ceda4090153aaa
- https://git.kernel.org/stable/c/e7f174715f9f0cbcb9e87b52e4fc4ef149baac98