CVE-2026-45990

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

slub: fix data loss and overflow in krealloc()

Commit 2cd8231796b5 ("mm/slub: allow to set node and align in

k[v]realloc") introduced the ability to force a reallocation if the

original object does not satisfy new alignment or NUMA node, even when

the object is being shrunk.

This introduced two bugs in the reallocation fallback path:

1. Data loss during NUMA migration: The jump to 'alloc_new' happens

before 'ks' and 'orig_size' are initialized. As a result, the

memcpy() in the 'alloc_new' block would copy 0 bytes into the new

allocation.

2. Buffer overflow during shrinking: When shrinking an object while

forcing a new alignment, 'new_size' is smaller than the old size.

However, the memcpy() used the old size ('orig_size ?: ks'), leading

to an out-of-bounds write.

The same overflow bug exists in the kvrealloc() fallback path, where the

old bucket size ksize(p) is copied into the new buffer withou

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References