CVE-2026-46281: vmalloc: fix buffer overflow in vrealloc_node_align()
In the Linux kernel, the following vulnerability has been resolved:
vmalloc: fix buffer overflow in vreallocnodealign()
Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation.
On this path (needrealloc), the code allocates a new object of 'size' bytes and then memcpy()s 'oldsize' bytes into it. If the request is to shrink the object (size < oldsize), this results in an out-of-bounds write on the new buffer.
Fix this by bounding the copy length by the new allocation size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the Linux kernel fix for the buffer overflow in vrealloc_node_align() by ensuring the copy length is bounded by the new allocation size (i.e., cap memcpy() to the new allocation size when vrealloc shrinks the object).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46281?
CVE-2026-46281 has a risk rating of 46.
What type of vulnerability is CVE-2026-46281?
CVE-2026-46281 is classified as a buffer overflow vulnerability in the Linux kernel.
How do I fix CVE-2026-46281?
To fix CVE-2026-46281, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What impact does CVE-2026-46281 have on systems?
The impact of CVE-2026-46281 can include potential crashes or arbitrary code execution due to the buffer overflow in memory allocation.
In which component of the Linux kernel does CVE-2026-46281 occur?
CVE-2026-46281 occurs in the vmalloc memory management component of the Linux kernel.