high 7.8

CVE-2026-46253 json

pstore/ram: fix buffer overflow in persistent_ram_save_old()

published 2026-06-03 5 mo ago modified 2026-10-19 20 d ago also EUVD-2026-34115

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records).

Currently, the function only allocates prz->old_log when it is NULL, but it unconditionally updates prz->old_log_size to the current buffer size and then performs memcpy_fromio() using this new size. If the buffer size has grown since the first allocation (which can happen across different kernel boot cycles), this leads to:

1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls 2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer using the incorrect (larger) old_log_size

The KASAN splat would look similar to: BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x... Read of size N at addr ... by task ...

The conditions are likely extremely hard to hit:

0. Crash with a ramoops write of less-than-record-max-size bytes. 1. Reboot: ramoops registers, pstore_get_records(0) reads old crash, allocates old_log with size X 2. Crash handler registered, timer started (if pstore_update_ms >= 0) 3. Oops happens (non-fatal, system continues) 4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X) 5. pstore_new_entry = 1, pstore_timer_kick() called 6. System continues running (not a panic oops) 7. Timer fires after pstore_update_ms milliseconds 8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1) 9. ramoops_get_next_prz() → persistent_ram_save_old() 10. buffer_size() returns Y, but old_log is X bytes 11. Y > X: memcpy_fromio() overflows heap

Requirements: - a prior crash record exists that did not fill the record size (almost impossible since the crash handler writes as much as it can possibly fit into the record, capped by max record size and the kmsg buffer almost always exceeds the max record size) - pstore_update_ms >= 0 (disabled by default) - Non-fatal oops (system survives)

Free and reallocate the buffer when the new size differs from the previously allocated size. This ensures old_log always has sufficient space for the data being copied.

Patch / fix

fixed in 1 distros 4 links 8

Linux Linux 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4, 7.0

debian ubuntu suse opensuse

linux Debian 12 6.1.170-1
linux Debian 13 6.12.85-1
linux Debian 14 6.18.14-1

debian advisories DEBIAN-CVE-2026-46253

linux Ubuntu 22.04 LTS 5.15.0-186.196
linux Ubuntu 24.04 LTS 6.8.0-134.134
linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
linux-aws Ubuntu 24.04 LTS 6.8.0-1060.63
linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
linux-gcp Ubuntu 24.04 LTS 6.8.0-1063.69
linux-gke Ubuntu 22.04 LTS 5.15.0-1108.114
linux-gke Ubuntu 24.04 LTS 6.8.0-1058.64

ubuntu advisories UBUNTU-CVE-2026-46253

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-default SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Live Patching 15 SP6 +1 more 6.4.0-150600.23.125.1
kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1
kernel-obs-build Linux Micro Extras 6.2 6.12.0-160000.36.1
kernel-rt Linux Micro 6.2 6.12.0-160000.36.1
kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1
kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1
kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.36.1
kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1.160000.2.17

suse advisories SUSE-SU-2026:3156-1 SUSE-SU-2026:22742-1 SUSE-SU-2026:22769-1 SUSE-SU-2026:22835-1 SUSE-SU-2026:22812-1 SUSE-SU-2026:3089-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.36.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.36.1

opensuse advisories openSUSE-SU-2026:21388-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-46253 updated 2026-11-06 cvss 4.7

kernel: pstore/ram: fix buffer overflow in persistent_ram_save_old()

Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: workaround, no fix available “Fix deferred”
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-46253
NVD CVE-2026-46253

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary