PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46289 Linux CVE debrief

A vulnerability was discovered in the Linux kernel's lib/scatterlist, specifically in the extract_kvec_to_sg function. The bug allowed the length of an sglist entry to exceed the number of bytes in a page when extracting from a kvec. Additionally, when extracting a user buffer, the sglist was temporarily used as a scratch buffer for extracted page pointers, potentially overlapping with existing entries. The vulnerability was introduced in kernel v6.3 and moved to lib/scatterlist.c in v6.5. The fix is marked for backports to v6.5+.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of Linux kernel versions prior to v6.5 who may be affected by this vulnerability.

Technical summary

The vulnerability is in the lib/scatterlist's extract_kvec_to_sg function. It was introduced in kernel v6.3 and moved to lib/scatterlist.c in v6.5. The bug could allow lengths of sglist entries to exceed page byte counts when extracting from kvecs. It also could cause sglist scratch buffer overlaps when extracting user buffers.

Defensive priority

High

Recommended defensive actions

  • Apply the patch or update to a Linux kernel version that includes the fix (v6.5 or later).
  • Review and test patches provided by Linux distribution vendors for backports to earlier kernel versions.

Evidence notes

The CVE was published on 2026-06-08 and modified on 2026-06-14. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46289 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46289

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46289 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46289

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/07b7d66e65d9cfe6b9c2c34aa22cfcaac37a5c45

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3f17500e86d730c76db638bb3ae52f9b5e496c76

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8fbba6829057979149d1b37d65690c037f3ddf4d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9d38756d0a93b66163554219fa9c3365f40c4035

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e5e22fc9963469e678c4f4bb38d26adcec107f1e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.