CVE-2026-46253
published 2026-06-03CVE-2026-46253: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can…
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
pstore/ram: fix buffer overflow in persistent_ram_save_old()
persistent_ram_save_old() can be called multiple times for the same
persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz
for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL,
but it unconditionally updates prz->old_log_size to the current buffer
size and then performs memcpy_fromio() using this new size. If the
buffer size has grown since the first allocation (which can happen
across different kernel boot cycles), this leads to:
1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer
using the incorrect (larger) old_log_size
The KASAN splat would look similar to:
BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...
Read of size N at addr ... by task ...
The conditions are likely extremely hard to hit:
0. Crash with a ramoops write of less-than-record-max-size bytes.
1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,
allocates old_log with size X
2. Crash handler registered, timer started (if pstore_update_ms >= 0)
3. Oops happens (non-fatal, system continues)
4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
5. pstore_new_entry = 1, pstore_timer_kick() called
6. System continues running (not a panic oops)
7. Timer fires after pstore_update_ms milliseconds
8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
9. ramoops_get_next_prz() → persistent_ram_save_old()
10. buffer_size() returns Y, but old_log is X bytes
11. Y > X: memcpy_fromio() overflows heap
Requirements:
- a prior crash record exists that did not fill the record size
(almost impossible since the crash handler writes as much as it
can possibly fit into the record, capped by max record size and
the kmsg buffer almost always exceeds the max record size)
Affected
55 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 58bda5a1d1ee98254383ef34f76b2c35140513ea | 58bda5a1d1ee98254383ef34f76b2c35140513ea |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 06d2c8bd108cea503f6f6e13e47495ed1085275f | 06d2c8bd108cea503f6f6e13e47495ed1085275f |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 2fa9a047c6a50ec80c3890dd623b85e237f0d1fd | 2fa9a047c6a50ec80c3890dd623b85e237f0d1fd |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < cff0ef043e16feb5a02307c8f9d0117a96c5587c | cff0ef043e16feb5a02307c8f9d0117a96c5587c |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 9a6fc69a570c0780834246d52c856cc3dbc2605f | 9a6fc69a570c0780834246d52c856cc3dbc2605f |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 4f73486ca822305c1cf5b8ebc0b53a6ab3801a81 | 4f73486ca822305c1cf5b8ebc0b53a6ab3801a81 |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 7cfe964e61c0ab667abd5f5b68e0acbf783efa4f | 7cfe964e61c0ab667abd5f5b68e0acbf783efa4f |
| linux | linux | >= 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 < 5669645c052f235726a85f443769b6fc02f66762 | 5669645c052f235726a85f443769b6fc02f66762 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.5.1 < 5.10.252 | 5.10.252 |
| linux | linux_kernel | >= 5.11 < 5.15.202 | 5.15.202 |
| linux | linux_kernel | >= 5.16 < 6.1.165 | 6.1.165 |
| linux | linux_kernel | >= 6.13 < 6.18.14 | 6.18.14 |
| linux | linux_kernel | >= 6.19 < 6.19.4 | 6.19.4 |
| linux | linux_kernel | >= 6.2 < 6.6.128 | 6.6.128 |
| linux | linux_kernel | >= 6.7 < 6.12.75 | 6.12.75 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-5.15 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel (FIPS) vulnerabilities
vendor_ubuntu·2026-07-10
CVE-2025-71235 Linux kernel (FIPS) vulnerabilities
Title: Linux kernel (FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monito
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-09
CVE-2026-45960 Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardwar
Ubuntu
Linux kernel (Raspberry Pi Real-time) vulnerabilities
vendor_ubuntu·2026-07-06
CVE-2026-43314 Linux kernel (Raspberry Pi Real-time) vulnerabilities
Title: Linux kernel (Raspberry Pi Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-02
CVE-2026-43314 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monitoring dr
Ubuntu
Linux kernel (Low Latency) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 8.8
CVE-2026-43314 [HIGH] Linux kernel (Low Latency) vulnerabilities
Title: Linux kernel (Low Latency) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a conta
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 7.8
CVE-2026-43314 [HIGH] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-02
CVE-2026-43314 Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardwar
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01
CVE-2026-43226 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monitoring dr
Red Hat
kernel: pstore/ram: fix buffer overflow in persistent_ram_save_old()
vendor_redhat·2026-06-03·CVSS 5.5
CVE-2026-46253 [MEDIUM] CWE-787 kernel: pstore/ram: fix buffer overflow in persistent_ram_save_old()
kernel: pstore/ram: fix buffer overflow in persistent_ram_save_old()
A flaw was found in the Linux kernel's `pstore/ram` component. This vulnerability, a heap buffer overflow, occurs when the system attempts to save old persistent RAM logs and the buffer size changes, leading to an out-of-bounds write. While the conditions for exploitation are extremely difficult to achieve, a successful exploit could lead to memory corruption, potentially causing system instability or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 8) - Fix defe
GHSA
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can be called multiple times for the same p
ghsa_unreviewed·2026-06-03
CVE-2026-46253 In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can be called multiple times for the same p
In the Linux kernel, the following vulnerability has been resolved:
pstore/ram: fix buffer overflow in persistent_ram_save_old()
persistent_ram_save_old() can be called multiple times for the same
persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz
for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL,
but it unconditionally updates prz->old_log_size to the current buffer
size and then performs memcpy_fromio() using this new size. If the
buffer size has grown since the first allocation (which can happen
across different kernel boot cycles), this leads to:
1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer
using the incorrect (large
VulDB
Linux Kernel up to 6.19.3 pstore persistent_ram_save_old heap-based overflow
vuldb·2026-06-03
CVE-2026-46253 [CRITICAL] Linux Kernel up to 6.19.3 pstore persistent_ram_save_old heap-based overflow
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.19.3. This issue affects the function persistent_ram_save_old of the component pstore. Such manipulation leads to heap-based buffer overflow.
This vulnerability is traded as CVE-2026-46253. Access to the local network is required for this attack to succeed. There is no exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/06d2c8bd108cea503f6f6e13e47495ed1085275fhttps://git.kernel.org/stable/c/2fa9a047c6a50ec80c3890dd623b85e237f0d1fdhttps://git.kernel.org/stable/c/4f73486ca822305c1cf5b8ebc0b53a6ab3801a81https://git.kernel.org/stable/c/5669645c052f235726a85f443769b6fc02f66762https://git.kernel.org/stable/c/58bda5a1d1ee98254383ef34f76b2c35140513eahttps://git.kernel.org/stable/c/7cfe964e61c0ab667abd5f5b68e0acbf783efa4fhttps://git.kernel.org/stable/c/9a6fc69a570c0780834246d52c856cc3dbc2605fhttps://git.kernel.org/stable/c/cff0ef043e16feb5a02307c8f9d0117a96c5587c
2026-06-03
Published