CVE-2026-64297

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297

Summary (CVE-2026-64297): The Linux kernel vuln arises from not checking the return value of module_extend_max_pages() inside the decompression path. When initial allocation fails, info->pages is NULL and info->max_pages is 0. Subsequent calls to module_get_next_page() may call module_exten...

PT-2026-64518

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module extend max pages module extend max pages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

The vulnerabilities of the functions module_gzip_decompress() and module_xz_decompress() in the kernel/module/decompress.c module of the Linux operating system’s kernel module loading subsystem allow a hacker to cause a service failure.

The vulnerability of the functions modulegzipdecompress and modulexzdecompress in the kernel/module/decompress.c module of the Linux operating system’s kernel module loading subsystem is related to improper checking of error values for pointers. Exploiting this vulnerability could allow an attack...

CVE-2023-22997

In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the modulegetnextpage return value expects it to be NULL in the error case, whereas it is actually an error pointer...