Skip to content
Fencer Vulns
high 7.8

CVE-2026-46281 json

vmalloc: fix buffer overflow in vrealloc_node_align()

published 2026-06-08 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-35146

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

vmalloc: fix buffer overflow in vrealloc_node_align()

Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation.

On this path (need_realloc), the code allocates a new object of 'size' bytes and then memcpy()s 'old_size' bytes into it. If the request is to shrink the object (size < old_size), this results in an out-of-bounds write on the new buffer.

Fix this by bounding the copy length by the new allocation size.

Patch / fix

  • Linux Linux 6.18.27, 7.0.4, 7.1
  • linux Debian 14 7.0.4-1

debian advisories DEBIAN-CVE-2026-46281

  • linux Ubuntu 26.04 LTS 7.0.0-27.27
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1008.8
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1007.7
  • linux-ibm Ubuntu 26.04 LTS 7.0.0-1009.9
  • linux-azure Ubuntu 26.04 LTS 7.0.0-1010.10
  • linux-raspi Ubuntu 26.04 LTS 7.0.0-1014.14
  • linux-riscv Ubuntu 26.04 LTS 7.0.0-27.27.1
  • linux-nvidia Ubuntu 26.04 LTS 7.0.0-1013.13

ubuntu advisories UBUNTU-CVE-2026-46281

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-source openSUSE Tumbleweed 7.0.12-1.1

opensuse advisories openSUSE-SU-2026:11014-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-46281 updated cvss 7.0

kernel: vmalloc: fix buffer overflow in vrealloc_node_align()

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.