CVE-2026-45990

Περιγραφή

In the Linux kernel, the following vulnerability has been resolved: slub: fix data loss and overflow in krealloc() Commit 2cd8231796b5 (-mm/slub: allow to set node and align in k[v]realloc-) introduced the ability to force a reallocation if the original object does not satisfy new alignment or NUMA node, even when the object is being shrunk. This introduced two bugs in the reallocation fallback path: 1. Data loss during NUMA migration: The jump to -alloc_new- happens before -ks- and -orig_size- are initialized. As a result, the memcpy() in the -alloc_new- block would copy 0 bytes into the new allocation. 2. Buffer overflow during shrinking: When shrinking an object while forcing a new alignment, -new_size- is smaller than the old size. However, the memcpy() used the old size (-orig_size ?: ks-), leading to an out-of-bounds write. The same overflow bug exists in the kvrealloc() fallback path, where the old bucket size ksize(p) is copied into the new buffer without being bounded by the n...