CVE-2026-45990
BaseFortify
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's memory allocator (slub) related to the krealloc() function, which reallocates memory. A recent change introduced the ability to force reallocation when the original memory object does not meet new alignment or NUMA node requirements, even if the object is being shrunk.
Two bugs were introduced in this reallocation fallback path: first, data loss during NUMA migration because the source size was not initialized before copying, resulting in zero bytes copied; second, a buffer overflow when shrinking an object with forced new alignment because the memcpy operation copied more bytes than the new smaller size, causing out-of-bounds writes.
These bugs can lead to memory corruption, demonstrated by an example reproducer that triggers an out-of-bounds write detected by kernel memory debugging tools.
How can this vulnerability impact me? :
This vulnerability can cause data loss and memory corruption within the Linux kernel's memory management subsystem.
Specifically, it can lead to out-of-bounds memory writes, which may cause system instability, crashes, or unpredictable behavior.
Such memory corruption issues can potentially be exploited by attackers to escalate privileges or execute arbitrary code, depending on the context and kernel usage.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the conditions that trigger the bug, such as using the provided simple reproducer code snippet that repeatedly calls krealloc_node_align with shrinking size and alignment forcing.
The reproducer example is:
- while (1) { void *p = kmalloc(128, GFP_KERNEL); p = krealloc_node_align(p, 64, 256, GFP_KERNEL, NUMA_NO_NODE); kfree(p); }
This will cause an out-of-bounds write detected by KFENCE, which can be observed in kernel logs.
To detect this on your system, you can monitor kernel logs for messages indicating out-of-bounds writes related to krealloc_node_align or use kernel debugging tools like KFENCE to catch such memory errors.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to a version that includes the fix for this vulnerability.
The fix involves moving the old size calculation to the top of __do_krealloc() and bounding all copy lengths by the new allocation size, preventing data loss and buffer overflow.
Until the kernel is updated, avoid workloads or code paths that trigger krealloc_node_align with shrinking and alignment forcing, as these can cause memory corruption.