https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:53:25 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46281 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vmalloc: fix buffer overflow in vrealloc_node_align()</p> <p>Commit 4c5d3365882d (&#34;mm/vmalloc: allow to set node and align in vrealloc&#34;) added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation.</p> <p>On this path (need_realloc), the code allocates a new object of &#39;size&#39; bytes and then memcpy()s &#39;old_size&#39; bytes into it. If the request is to shrink the object (size &lt; old_size), this results in an out-of-bounds write on the new buffer.</p> <p>Fix this by bounding the copy length by the new allocation size.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vmalloc: fix buffer overflow in vrealloc_node_align()</p> <p>Commit 4c5d3365882d (&#34;mm/vmalloc: allow to set node and align in vrealloc&#34;) added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation.</p> <p>On this path (need_realloc), the code allocates a new object of &#39;size&#39; bytes and then memcpy()s &#39;old_size&#39; bytes into it. If the request is to shrink the object (size &lt; old_size), this results in an out-of-bounds write on the new buffer.</p> <p>Fix this by bounding the copy length by the new allocation size.</p> https://vulnerability.circl.lu/vuln/cve-2026-46281