Skip to main content

Linux Kernel CVE-2026-64297

| EUVDEUVD-2026-49009 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-25 Linux GHSA-5c7j-4454-42wh
Null Pointer Dereference Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.1 MEDIUM

Module loading requires CAP_SYS_MODULE (PR:H); triggering the allocation failure demands deliberate memory pressure (AC:H); impact is availability-only with no scope change.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 15:10 vuln.today
CVSS changed
Aug 12, 2026 - 15:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

module: decompress: check return value of module_extend_max_pages()

module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked.

If the initial allocation fails, info->pages remains NULL and info->max_pages remains 0. Subsequent calls to module_get_next_page() will attempt to dynamically grow the array by calling module_extend_max_pages(info, 0) since info->used_pages is 0. This results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel oops.

Fix: add the missing error check after module_extend_max_pages() and return immediately on failure. This matches the pattern used by every other kvrealloc() caller in the module loading path.

[Sami: Corrected the analysis in the commit message.]

AnalysisAI

Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.

Technical ContextAI

The vulnerability resides in the kernel module loading subsystem, specifically the decompression path. The function module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure, but its callers never check this return value. When the initial allocation fails, info->pages remains NULL and info->max_pages stays at 0. Subsequent calls to module_get_next_page() attempt to grow the array by calling module_extend_max_pages(info, 0), which in turn calls kvrealloc(NULL, 0). Linux's kvrealloc() returns ZERO_SIZE_PTR (a non-NULL sentinel, typically 0x10) for zero-size allocations rather than NULL, causing the caller to treat the failed allocation as successful. Dereferencing ZERO_SIZE_PTR then triggers a kernel oops. The root cause is CWE-476 (NULL Pointer Dereference), though more precisely it is a ZERO_SIZE_PTR dereference - a well-known Linux memory safety footgun. Affected CPEs: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release: 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or any 7.2-rc1+ build. Patch commits are available at https://git.kernel.org/stable/c/e7f174715f9f0cbcb9e87b52e4fc4ef149baac98 and related stable-tree commits linked in references. As a compensating control where immediate kernel upgrade is not possible, administrators can restrict module loading via the sysctl kernel.modules_disabled=1 (note: this is a one-way latch and prevents all subsequent module loading until reboot, which may impact device drivers and filesystems). Alternatively, MAC frameworks such as SELinux or AppArmor can be configured to deny module loading to non-root contexts, removing the attack surface without fully disabling module functionality. Restricting CAP_SYS_MODULE in container runtimes (e.g., removing it from Kubernetes pod security policies or Docker capabilities) is the most practical mitigation for cloud workloads. No patch version should be inferred beyond those listed above.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-64297 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy