PT-2026-64518 · Linux · Linux
CVE-2026-64297
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
module: decompress: check return value of module extend max pages()
module extend max pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.
If the initial allocation fails, info->pages remains NULL and
info->max pages remains 0. Subsequent calls to module get next page()
will attempt to dynamically grow the array by calling
module extend max pages(info, 0) since info->used pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO SIZE PTR, which is treated
as a success, leading to a dereference of ZERO SIZE PTR and a kernel
oops.
Fix: add the missing error check after module extend max pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.
[Sami: Corrected the analysis in the commit message.]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux