CVE-2026-46253

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

pstore/ram: fix buffer overflow in persistent_ram_save_old()

persistent_ram_save_old() can be called multiple times for the same

persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz

for PSTORE_TYPE_DMESG records).

Currently, the function only allocates prz->old_log when it is NULL,

but it unconditionally updates prz->old_log_size to the current buffer

size and then performs memcpy_fromio() using this new size. If the

buffer size has grown since the first allocation (which can happen

across different kernel boot cycles), this leads to:

1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls

2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer

using the incorrect (larger) old_log_size

The KASAN splat would look similar to:

BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...

Read of size N at addr ... by task ...

The conditions are likely extremely h

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References