Homepage

Out-of-bounds Write Affecting kernel-rt-debug-kvm package, versions *

Severity

 Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.03% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Out-of-bounds Write vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS10-KERNELRTDEBUGKVM-17142759
  • published4 Jun 2026
  • disclosed3 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 3 Jun 2026

NewCVE-2026-46253  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

There is no fixed version for Centos:10 kernel-rt-debug-kvm.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug-kvm package and not the kernel-rt-debug-kvm package as distributed by Centos. See How to fix? for Centos:10 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

pstore/ram: fix buffer overflow in persistent_ram_save_old()

persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records).

Currently, the function only allocates prz->old_log when it is NULL, but it unconditionally updates prz->old_log_size to the current buffer size and then performs memcpy_fromio() using this new size. If the buffer size has grown since the first allocation (which can happen across different kernel boot cycles), this leads to:

  1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
  2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer using the incorrect (larger) old_log_size

The KASAN splat would look similar to: BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x... Read of size N at addr ... by task ...

The conditions are likely extremely hard to hit:

  1. Crash with a ramoops write of less-than-record-max-size bytes.
  2. Reboot: ramoops registers, pstore_get_records(0) reads old crash, allocates old_log with size X
  3. Crash handler registered, timer started (if pstore_update_ms >= 0)
  4. Oops happens (non-fatal, system continues)
  5. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
  6. pstore_new_entry = 1, pstore_timer_kick() called
  7. System continues running (not a panic oops)
  8. Timer fires after pstore_update_ms milliseconds
  9. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
  10. ramoops_get_next_prz() → persistent_ram_save_old()
  11. buffer_size() returns Y, but old_log is X bytes
  12. Y > X: memcpy_fromio() overflows heap

Requirements:

  • a prior crash record exists that did not fill the record size (almost impossible since the crash handler writes as much as it can possibly fit into the record, capped by max record size and the kmsg buffer almost always exceeds the max record size)
  • pstore_update_ms >= 0 (disabled by default)
  • Non-fatal oops (system survives)

Free and reallocate the buffer when the new size differs from the previously allocated size. This ensures old_log always has sufficient space for the data being copied.

CVSS Base Scores

version 3.1