CVE-2026-46281: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46281 Overview

CVE-2026-46281 is a buffer overflow vulnerability in the Linux kernel's vmalloc subsystem, specifically in the vrealloc_node_align() function. The flaw was introduced by commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc"), which added logic to force a new allocation when the existing pointer resides on the wrong NUMA node or fails an alignment constraint. On the need_realloc code path, the kernel allocates a new buffer of the requested size and then copies old_size bytes into it. When a caller shrinks an allocation (size < old_size), the copy length exceeds the destination buffer, producing an out-of-bounds write.

Critical Impact
An out-of-bounds write in the kernel vmalloc allocator can corrupt adjacent kernel memory, leading to instability, denial of service, or potential local privilege escalation depending on adjacent allocations.

Affected Products

Linux kernel versions containing commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc")
Linux distributions shipping the affected mm/vmalloc.c code path prior to the fix commits
Stable kernel branches referenced by the upstream fix commits 82d1f01, b281adf7, and e9b057a4

Discovery Timeline

2026-06-08 - CVE-2026-46281 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46281

Vulnerability Analysis

The vulnerability resides in vrealloc_node_align() within the Linux kernel memory management subsystem (mm/vmalloc.c). The vrealloc family of functions resizes an existing virtually contiguous kernel allocation. The introduction of NUMA node and alignment constraints created a new code path, need_realloc, that forces a fresh allocation when the current pointer does not satisfy the requested node or alignment, regardless of whether the caller is growing or shrinking the buffer.

On this path, the function allocates size bytes for the new buffer and then issues a memcpy() of old_size bytes from the source. When size < old_size (a shrink request), the memcpy() writes past the end of the newly allocated destination. This is a classic out-of-bounds write in kernel memory. The upstream fix bounds the copy length to the smaller of size and old_size, ensuring the destination buffer is never overrun.

Root Cause

The root cause is a missing boundary check between the source length (old_size) and the destination length (size) in the need_realloc branch of vrealloc_node_align(). The original vrealloc shrink path assumed in-place resizing, so no clamp was required. The new node and alignment branch did not account for the shrink case when copying contents into the freshly allocated buffer. The defect is categorized as a buffer overflow and out-of-bounds write in kernel space.

Attack Vector

Exploitation requires a code path that invokes vrealloc() with a smaller size than the original allocation while also triggering the need_realloc condition through a NUMA node mismatch or alignment requirement. Triggering this path generally requires local kernel-adjacent code, such as a kernel module or a syscall that exposes vrealloc-backed allocations to user-controlled sizing. The vulnerability is described in upstream kernel commits referenced by Kernel Git Commit 82d1f01, Kernel Git Commit b281adf7, and Kernel Git Commit e9b057a4.

No public proof-of-concept exploit code is available for CVE-2026-46281. The vulnerability is described in prose based on the upstream commit messages, which document the unbounded memcpy() in the shrink-with-realloc path.

Detection Methods for CVE-2026-46281

Indicators of Compromise

Unexpected kernel oops, panics, or BUG: messages referencing vrealloc, vrealloc_node_align, or vmalloc in dmesg or /var/log/kern.log.
KASAN reports flagging out-of-bounds writes in vrealloc_node_align() or adjacent vmalloc allocations on instrumented kernels.
Sporadic memory corruption symptoms in kernel subsystems that consume vrealloc-backed buffers following workload changes that alter allocation sizes.

Detection Strategies

Enable Kernel Address Sanitizer (CONFIG_KASAN) on test and pre-production kernels to surface out-of-bounds writes in the vmalloc path.
Compare the running kernel version against the fix commits 82d1f01, b281adf7, and e9b057a4 to confirm whether the patched code is present.
Audit in-tree and out-of-tree modules that call vrealloc() or vrealloc_node_align() with shrinking sizes combined with node or alignment constraints.

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized logging or SIEM platform and alert on vmalloc, vrealloc, or KASAN signatures.
Track kernel crash dumps and kdump output for repeated faults that correlate with workloads exercising vrealloc consumers.
Maintain an inventory of Linux kernel versions across hosts and flag systems running unpatched builds against the upstream fix references.

How to Mitigate CVE-2026-46281

Immediate Actions Required

Update affected Linux kernels to a stable release that incorporates commits 82d1f01, b281adf7, or e9b057a4.
Track distribution security advisories from your Linux vendor and deploy patched kernel packages once available.
Restrict local access on multi-tenant systems until patched kernels are deployed, as triggering the vulnerable path requires local execution context.

Patch Information

The upstream fix bounds the memcpy() length in vrealloc_node_align() so that the copy never exceeds the new allocation size. Apply one of the upstream stable commits: Kernel Git Commit 82d1f01, Kernel Git Commit b281adf7, or Kernel Git Commit e9b057a4. Rebuild and reboot affected systems to activate the patched kernel.

Workarounds

No supported configuration workaround exists; the defect lives in core kernel memory management code reachable through standard vrealloc() callers.
Limit loading of untrusted kernel modules that may exercise vrealloc shrink paths with NUMA or alignment constraints.
Where feasible, run security-sensitive workloads on hosts with kernels predating commit 4c5d3365882d until patched builds are deployed.

bash

# Verify the running kernel version and check for the fix
uname -r

# On distributions using apt, install the latest kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//') linux-image-generic
sudo reboot

# On distributions using dnf/yum
sudo dnf update kernel && sudo reboot