PT-2026-64518 · Linux · Linux
CVE-2026-64297
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
module: decompress: check return value of module extend max pages()
module extend max pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.
If the initial allocation fails, info->pages remains NULL and
info->max pages remains 0. Subsequent calls to module get next page()
will attempt to dynamically grow the array by calling
module extend max pages(info, 0) since info->used pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO SIZE PTR, which is treated
as a success, leading to a dereference of ZERO SIZE PTR and a kernel
oops.
Fix: add the missing error check after module extend max pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.
[Sami: Corrected the analysis in the commit message.]
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux