PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46284 Linux CVE debrief

CVE-2026-46284 is a vulnerability in the Linux kernel that can cause an early boot crash when hugepages, hugepagesz, or default_hugepagesz are specified on the kernel command line without the '=' separator. This is due to early parameter parsing passing NULL to hugetlb_add_param(), which dereferences it in strlen() and can crash the system during early boot. The vulnerability has been resolved by rejecting NULL values in hugetlb_add_param() and returning -EINVAL instead.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel who pass hugepages, hugepagesz, or default_hugepagesz on the kernel command line should be aware of this vulnerability.

Technical summary

The Linux kernel vulnerability (CVE-2026-46284) occurs when hugepages, hugepagesz, or default_hugepagesz are specified on the kernel command line without the '=' separator. Early parameter parsing passes NULL to hugetlb_add_param(), which can cause a system crash during early boot. The fix involves rejecting NULL values in hugetlb_add_param() and returning -EINVAL.

Defensive priority

medium

Recommended defensive actions

  • Apply the kernel patch that rejects NULL values in hugetlb_add_param() and returns -EINVAL.
  • Ensure that hugepages, hugepagesz, or default_hugepagesz are specified with the '=' separator on the kernel command line.

Evidence notes

The CVE was published on 2026-06-08T17:16:46.193Z and has not been modified since then. The vulnerability has been resolved in the Linux kernel.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46284 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46284

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46284 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46284

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2774bcf714739cc6bb86f8812167bb9fbda70f6a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/357c6d084b6137ae640209c5bfd01180f985c015

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c45b354911d01565156e38d7f6bc07edb51fc34c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.