CVE-2026-64297

Analyzed Analyzed - Analysis Complete

Memory Corruption in Linux Kernel Module Loading

Publication date: 2026-07-25

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails, info->pages remains NULL and info->max_pages remains 0. Subsequent calls to module_get_next_page() will attempt to dynamically grow the array by calling module_extend_max_pages(info, 0) since info->used_pages is 0. This results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel oops. Fix: add the missing error check after module_extend_max_pages() and return immediately on failure. This matches the pattern used by every other kvrealloc() caller in the module loading path. [Sami: Corrected the analysis in the commit message.]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-12

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64297

EUVD

EUVD-2026-49009

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 5.17 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel occurs when module_extend_max_pages() fails to allocate memory but its return value is not checked. If allocation fails, info->pages becomes NULL and info->max_pages is 0. Later, module_get_next_page() tries to grow the array, leading to a kernel oops due to dereferencing a null pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level inspection. Detection involves checking for kernel oops or crashes related to module loading failures. Monitor system logs for kernel panic or oops messages. Use commands like dmesg | grep -i oops or journalctl -k | grep -i oops to identify such events.

Impact Analysis

This vulnerability can cause a kernel crash (oops) on affected systems, leading to denial of service. Systems running vulnerable Linux kernel versions may become unresponsive or require a reboot.

Compliance Impact

This vulnerability is a kernel oops caused by a NULL pointer dereference in the Linux kernel's module loading path. It does not directly relate to data protection or privacy controls required by GDPR or HIPAA, as it primarily impacts system stability and availability rather than data confidentiality or integrity.

Mitigation Strategies

Apply the latest kernel patch provided by your Linux distribution to fix the missing error check in module_extend_max_pages(). If patching is not immediately possible, restrict module loading to trusted sources and disable unneeded kernel modules to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-64297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70