CVE-2026-64297 Overview
CVE-2026-64297 is a Linux kernel vulnerability in the module decompression path. The function module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure, but the return value was never checked by its caller. When the initial allocation fails, info->pages remains NULL and info->max_pages remains 0. Subsequent calls to module_get_next_page() attempt to grow the array, resulting in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR. The kernel treats this as success and dereferences the sentinel pointer, triggering a kernel oops.
Critical Impact
A failed memory allocation during compressed module loading can trigger a kernel oops through dereference of ZERO_SIZE_PTR, resulting in denial of service on affected systems.
Affected Products
- Linux kernel versions containing the module decompression code path that calls module_extend_max_pages() without checking the return value
- Stable kernel branches referenced in the upstream fix commits
- Distributions shipping affected mainline and stable kernels prior to backport
Discovery Timeline
- 2026-07-25 - CVE-2026-64297 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64297
Vulnerability Analysis
The defect resides in the Linux kernel module loader's decompression logic. module_extend_max_pages() is responsible for growing the internal page array used to hold a decompressed module image. It wraps kvrealloc() and propagates allocation failures with -ENOMEM. The caller in the decompression path did not check this return value, allowing execution to continue after a failed allocation.
When the failure occurs on the first invocation, info->pages stays NULL and info->max_pages remains 0. The next call to module_get_next_page() observes info->used_pages == 0 and re-invokes module_extend_max_pages(info, 0). That call reaches kvrealloc(NULL, 0), which returns the ZERO_SIZE_PTR sentinel. Because the caller lacks proper error handling, the sentinel is written into info->pages and later dereferenced, causing a kernel oops.
Root Cause
The root cause is a missing error check [CWE-252] after module_extend_max_pages() in the module decompression path. Every other kvrealloc() caller in the module loader validates the return value, making this an inconsistency introduced in the decompression helper.
Attack Vector
Triggering the fault requires the kernel to enter the compressed module load path under memory pressure sufficient to make kvrealloc() fail. Local workloads that induce memory exhaustion while modules are being loaded on demand can reach the vulnerable state. No remote attack vector or memory corruption primitive has been documented; the observed outcome is a kernel oops.
No verified proof-of-concept code is published. Refer to the upstream commits linked in the kernel.org stable tree for the corrected error-handling pattern.
Detection Methods for CVE-2026-64297
Indicators of Compromise
- Kernel oops entries in dmesg or journalctl -k referencing module_get_next_page or module_extend_max_pages in the call trace
- Faulting address matching the ZERO_SIZE_PTR sentinel value near address 0x10
- Module load failures correlated with system-wide memory pressure events
Detection Strategies
- Monitor kernel logs for Oops and BUG messages originating in the module loading subsystem, particularly the compressed module path.
- Compare running kernel build identifiers against distribution advisories that reference the upstream commits for this fix.
- Correlate module-load telemetry with out-of-memory conditions to surface systems repeatedly entering the vulnerable code path.
Monitoring Recommendations
- Forward kernel ring buffer contents to a centralized logging platform for anomaly review.
- Alert on repeated kernel oops events across a fleet, which may indicate systemic exposure to this defect.
- Track kernel package versions across Linux endpoints and servers to identify hosts still running unpatched builds.
How to Mitigate CVE-2026-64297
Immediate Actions Required
- Apply the vendor kernel update that incorporates the upstream fix referenced by commits 168072baf9ad, 786d2d84416a, a82e17063e50, afcc0515bbdd, e7da02659c22, and e7f174715f9f.
- Reboot affected systems after patching to load the corrected kernel image.
- Verify that stable-tree backports are present on long-term-support kernels used in production.
Patch Information
The fix adds the missing error check after module_extend_max_pages() and returns immediately on failure, matching the pattern used by every other kvrealloc() caller in the module loading path. Patches are available in the mainline and stable Linux kernel trees. Consult the kernel.org commit and the associated stable backports for exact version boundaries.
Workarounds
- Reduce reliance on on-demand loading of compressed modules where feasible by preloading required modules during boot.
- Enforce memory limits and monitoring to reduce the likelihood of allocation failures in the module loader.
- Restrict local access on multi-tenant systems until the patched kernel is deployed, as reaching the code path typically requires local activity.
# Verify installed kernel version and check for the fix
uname -r
# Example: query distribution package manager for the patched kernel
# Debian/Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# RHEL/Fedora
rpm -q kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
