PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45990 Linux CVE debrief

A vulnerability in the Linux kernel's SLUB allocator affects krealloc() and kvrealloc() operations. The issue stems from commit 2cd8231796b5, which introduced forced reallocation capabilities for alignment and NUMA node changes. Two distinct bugs were introduced in the fallback reallocation path: data loss during NUMA migration due to uninitialized size variables causing zero-byte copies, and buffer overflow during shrinking operations where the original object size was used for memcpy() instead of the new smaller size. The overflow condition occurs when krealloc_node_align() shrinks an object while forcing new alignment, copying up to 120 bytes beyond the allocated buffer as demonstrated by KFENCE detection. The fix relocates old size calculation to the start of __do_krealloc() and bounds all copy operations by the new allocation size.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux kernel maintainers, distribution security teams, organizations running custom kernel builds, and security researchers tracking kernel memory safety issues

Technical summary

The vulnerability exists in mm/slub.c in the Linux kernel's __do_krealloc() function. When forced reallocation occurs due to alignment or NUMA node mismatches, two code paths fail to properly handle size calculations. In the NUMA migration path, jumping to 'alloc_new' before initializing 'ks' and 'orig_size' results in memcpy() copying zero bytes, causing silent data loss. In the shrinking path with forced alignment, memcpy() uses the original object size rather than new_size, writing beyond the allocated buffer. The kvrealloc() function shares the same overflow bug in its fallback path. The fix moves size calculation to function entry and applies min() bounding to all copy operations.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor kernel security advisories from your Linux distribution for updated packages
  • If running custom kernel builds, cherry-pick fix commits to affected branches
  • Enable KFENCE or similar kernel memory safety detectors to detect exploitation attempts
  • Review code using krealloc_node_align() with shrinking size parameters and forced alignment
  • Audit kvrealloc() usage patterns that may trigger the fallback reallocation path

Evidence notes

Vulnerability introduced in commit 2cd8231796b5 (mm/slub: allow to set node and align in k[v]realloc). Fix commits provided for stable kernel branches. KFENCE detection confirms out-of-bounds write of 120 bytes past 64-byte allocation when shrinking from 128 bytes with 256-byte alignment. Affects krealloc_node_align_noprof and kvrealloc fallback paths.

Official resources

2026-05-27