CVE-2026-64297: module: decompress: check return value of module_extend_max_pages()
In the Linux kernel, the following vulnerability has been resolved:
module: decompress: check return value of moduleextendmaxpages()
moduleextendmaxpages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked.
If the initial allocation fails, info->pages remains NULL and info->maxpages remains 0. Subsequent calls to modulegetnextpage() will attempt to dynamically grow the array by calling moduleextendmaxpages(info, 0) since info->usedpages is 0. This results in kvrealloc(NULL, 0) returning ZEROSIZEPTR, which is treated as a success, leading to a dereference of ZEROSIZEPTR and a kernel oops.
Fix: add the missing error check after moduleextendmaxpages() and return immediately on failure. This matches the pattern used by every other kvrealloc() caller in the module loading path.
[Sami: Corrected the analysis in the commit message.]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In module: decompress, add the missing error check after module_extend_max_pages(); if the call fails and info->pages remains NULL (e.g., module_extend_max_pages(info, 0) after module_extend_max_pages() returns failure), ensure subsequent module_get_next_page() calls do not proceed and that the function returns immediately on failure.
Linux kernel (module: decompress) module_extend_max_pages() return value handling = check return value after module_extend_max_pages() and return immediately on failure
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64297?
The severity of CVE-2026-64297 is medium with a CVSS score of 5.5.
How do I fix CVE-2026-64297?
You can fix CVE-2026-64297 by applying the available patch provided in the Linux kernel updates.
What vulnerability does CVE-2026-64297 address?
CVE-2026-64297 addresses a vulnerability in the Linux kernel related to the unchecked return value of the module_extend_max_pages() function.
What are the potential consequences of CVE-2026-64297?
The potential consequences of CVE-2026-64297 include a null pointer dereference which could lead to system crashes or unexpected behavior.
When was CVE-2026-64297 published?
CVE-2026-64297 was published on July 25, 2026.