PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46281 Linux CVE debrief

A buffer overflow vulnerability exists in the Linux kernel's vmalloc function, specifically in the vrealloc_node_align function. This function is used to reallocate memory and can lead to an out-of-bounds write if the requested size is smaller than the original size. The vulnerability was introduced by a commit that allowed forcing a new allocation if the current pointer is on the wrong NUMA node or if an alignment constraint is not met, even if the user is shrinking the allocation.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Linux kernel developers and users who rely on the vmalloc function should be aware of this vulnerability. This vulnerability may allow an attacker to escalate privileges or cause a denial of service.

Technical summary

The vrealloc_node_align function in the Linux kernel's vmalloc module has a buffer overflow vulnerability. When the function is called with a size smaller than the original size, it can lead to an out-of-bounds write. This is because the function allocates a new buffer of 'size' bytes and then copies 'old_size' bytes into it, where 'old_size' is the original size of the buffer.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from the Linux kernel repository [ref-4](https://git.kernel.org/stable/c/82d1f01292d3f09bf063f829f8ab8de12b4280a1), [ref-5](https://git.kernel.org/stable/c/b281adf71f786c325eb6d6d1582d4d05313438a8), or [c

Evidence notes

The Linux kernel repository has patches available to fix this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46281 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46281

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46281 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46281

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/82d1f01292d3f09bf063f829f8ab8de12b4280a1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b281adf71f786c325eb6d6d1582d4d05313438a8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e9b057a44deff4c59c13f44672a5cc74dcd57522

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.