Linux Kernel CVE-2026-46281

The vulnerability lives in mm/vmalloc.c, the kernel's virtually-contiguous allocator used for large in-kernel buffers. Commit 4c5d3365882d ('mm/vmalloc: allow to set node and align in vrealloc') extended vrealloc_node_align() to force a fresh allocation when the existing pointer sits on the wrong NUMA node or violates an alignment constraint, even during a shrink. On that need_realloc path the code allocates 'size' bytes for the new object but copies 'old_size' bytes from the original, so when size < old_size it writes past the end of the freshly allocated buffer. This is a textbook CWE-787 (Out-of-bounds Write): the copy length was not bounded by the destination size. The fix clamps the memcpy length to the new allocation size. Affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel itself; exposure depends on which kernel callers of vrealloc with node/alignment hints can be reached.