143 lines
7.9 KiB
JSON
143 lines
7.9 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-45990",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-05-13T15:03:33.091Z",
|
|
"datePublished": "2026-05-27T12:55:42.572Z",
|
|
"dateUpdated": "2026-06-14T17:46:45.762Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-06-14T17:46:45.762Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslub: fix data loss and overflow in krealloc()\n\nCommit 2cd8231796b5 (\"mm/slub: allow to set node and align in\nk[v]realloc\") introduced the ability to force a reallocation if the\noriginal object does not satisfy new alignment or NUMA node, even when\nthe object is being shrunk.\n\nThis introduced two bugs in the reallocation fallback path:\n\n1. Data loss during NUMA migration: The jump to 'alloc_new' happens\n before 'ks' and 'orig_size' are initialized. As a result, the\n memcpy() in the 'alloc_new' block would copy 0 bytes into the new\n allocation.\n\n2. Buffer overflow during shrinking: When shrinking an object while\n forcing a new alignment, 'new_size' is smaller than the old size.\n However, the memcpy() used the old size ('orig_size ?: ks'), leading\n to an out-of-bounds write.\n\nThe same overflow bug exists in the kvrealloc() fallback path, where the\nold bucket size ksize(p) is copied into the new buffer without being\nbounded by the new size.\n\nA simple reproducer:\n\n\t// e.g. add to lkdtm as KREALLOC_SHRINK_OVERFLOW\n\twhile (1) {\n\t\tvoid *p = kmalloc(128, GFP_KERNEL);\n\t\tp = krealloc_node_align(p, 64, 256, GFP_KERNEL, NUMA_NO_NODE);\n\t\tkfree(p);\n\t}\n\ndemonstrates the issue:\n\n ==================================================================\n BUG: KFENCE: out-of-bounds write in memcpy_orig+0x68/0x130\n\n Out-of-bounds write at 0xffff8883ad757038 (120B right of kfence-#47):\n memcpy_orig+0x68/0x130\n krealloc_node_align_noprof+0x1c8/0x340\n lkdtm_KREALLOC_SHRINK_OVERFLOW+0x8c/0xc0 [lkdtm]\n lkdtm_do_action+0x3a/0x60 [lkdtm]\n ...\n\n kfence-#47: 0xffff8883ad756fc0-0xffff8883ad756fff, size=64, cache=kmalloc-64\n\n allocated by task 316 on cpu 7 at 97.680481s (0.021813s ago):\n krealloc_node_align_noprof+0x19c/0x340\n lkdtm_KREALLOC_SHRINK_OVERFLOW+0x8c/0xc0 [lkdtm]\n lkdtm_do_action+0x3a/0x60 [lkdtm]\n ...\n ==================================================================\n\nFix it by moving the old size calculation to the top of __do_krealloc()\nand bounding all copy lengths by the new allocation size."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/slub.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2cd8231796b5e7133b1c3d66ad7d2a3c42c97258",
|
|
"lessThan": "38387ccc0fbe38d14fb4c2ad7ee1d7404e5e59fd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2cd8231796b5e7133b1c3d66ad7d2a3c42c97258",
|
|
"lessThan": "550fa6b5aabb096554536ac1e3ec96b76cbb35fd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2cd8231796b5e7133b1c3d66ad7d2a3c42c97258",
|
|
"lessThan": "082a6d03a2d685a83a332666b500ad3966349588",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/slub.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.18",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.18",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.27",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.4",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "6.18.27"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "7.0.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/38387ccc0fbe38d14fb4c2ad7ee1d7404e5e59fd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/550fa6b5aabb096554536ac1e3ec96b76cbb35fd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/082a6d03a2d685a83a332666b500ad3966349588"
|
|
}
|
|
],
|
|
"title": "slub: fix data loss and overflow in krealloc()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |