CVE-2026-64297

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

module: decompress: check return value of module_extend_max_pages()

module_extend_max_pages() calls kvrealloc() internally and returns

-ENOMEM on allocation failure. The return value is never checked.

If the initial allocation fails, info->pages remains NULL and

info->max_pages remains 0. Subsequent calls to module_get_next_page()

will attempt to dynamically grow the array by calling

module_extend_max_pages(info, 0) since info->used_pages is 0. This

results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated

as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel

oops.

Fix: add the missing error check after module_extend_max_pages() and

return immediately on failure. This matches the pattern used by every

other kvrealloc() caller in the module loading path.

[Sami: Corrected the analysis in the commit message.]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References