CVE-2026-46253
Heap Buffer Overflow in Linux Kernel pstore/ram
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's pstore/ram subsystem, specifically in the function persistent_ram_save_old(). The function can be called multiple times for the same persistent_ram_zone, but it only allocates memory for the old_log buffer if it is NULL. However, it updates the old_log_size unconditionally and then copies data into the buffer using memcpy_fromio() with the new size. If the buffer size has increased since the first allocation (which can happen across different kernel boot cycles), this causes a heap buffer overflow (out-of-bounds write) during the copy operation and an out-of-bounds read later when accessing the buffer.
The vulnerability is triggered under very specific and rare conditions involving multiple system crashes and reboots, non-fatal kernel oopses, and certain timing parameters. Essentially, if a crash record exists that did not fill the maximum record size, and the system continues running after a non-fatal oops with pstore_update_ms enabled, the buffer allocated for old_log may be too small for the new data, leading to the overflow.
The fix involves freeing and reallocating the buffer whenever the new size differs from the previously allocated size, ensuring the buffer always has enough space for the data being copied.
How can this vulnerability impact me? :
This vulnerability can lead to a heap buffer overflow in the Linux kernel, which may cause memory corruption. Such memory corruption can potentially be exploited to execute arbitrary code, cause system crashes, or lead to denial of service conditions.
However, the conditions required to trigger this vulnerability are extremely rare and complex, involving multiple system crashes, specific kernel configurations, and timing parameters. Therefore, the practical impact on most users is limited.
Still, if exploited, it could compromise system stability and security, potentially allowing attackers to gain elevated privileges or disrupt system operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a heap buffer overflow in the Linux kernel's persistent RAM subsystem, specifically in the persistent_ram_save_old() function. Detection would involve monitoring kernel logs for signs of out-of-bounds memory access errors related to ramoops_pstore_read.
A typical indicator is a KASAN (Kernel Address Sanitizer) error message similar to: "BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x..." which indicates an out-of-bounds read or write.
To detect this on your system, you can check the kernel logs for such errors using commands like:
- dmesg | grep -i kasan
- journalctl -k | grep -i kasan
- grep -i 'ramoops_pstore_read' /var/log/kern.log
Additionally, monitoring for non-fatal kernel oops events and persistent RAM crash records may help identify conditions leading to this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by improper handling of buffer sizes in persistent_ram_save_old(), leading to heap buffer overflows when the buffer size grows between kernel boots.
Immediate mitigation steps include:
- Apply the patch that frees and reallocates the buffer when the new size differs from the previously allocated size, ensuring the buffer is always large enough.
- Disable the pstore_update_ms feature (set it to a negative value) to prevent the timer-based update mechanism that triggers the vulnerable code path, as it is disabled by default.
- Monitor and avoid conditions that lead to non-fatal kernel oops events that survive system reboots, as these are required to trigger the vulnerability.
Ultimately, updating the Linux kernel to a version that includes the fix for this vulnerability is the most effective mitigation.