dbcve.org
Linux KernelOperating system · Linux

CVE-2026-46289

CRITICAL · 9.8 CVSS v3.1 Published 2026-06-08
Fix available
A fix is available. Upgrade to 6.6.140 / 6.12.88 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch series "Fix bugs in extract_iter_to_sg()", v3. Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev. The main bugs are: - The length for an sglist entry when extracting from a kvec can exceed the number of bytes in the page. This is obviously not intended. - When extracting a user buffer the sglist is temporarily used as a scratch buffer for extracted page pointers. If the sglist already contains some elements this scratch buffer could overlap with existing entries in the sglist. The series adds test cases to the kunit_iov_iter test that demonstrate all of these bugs. Additionally, there is a memory leak fix for the test itself. The bugs were orignally introduced into kernel v6.3 where the function lived in fs/netfs/iterator.c. It was later moved to lib/scatterlist.c in v6.5. Thus the actual fix is only marked for backports to v6.5+. This patch (of 5): When extracting from a kvec to a scatterlist, do not cross page boundaries. The required length was already calculated but not used as intended. Adjust the copied length if the loop runs out of sglist entries without extracting everything. While there, return immediately from extract_iter_to_sg if there are no sglist entries at all. A subsequent commit will add kunit test cases that demonstrate that the patch is necessary.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A memory corruption vulnerability in the Linux kernel's scatterlist handling (lib/scatterlist.c) where the extract_kvec_to_sg function fails to properly enforce page boundaries when copying data from kvec iterators to scatterlists. This can cause sglist entries to exceed page boundaries, potentially leading to buffer overflows and memory corruption. Additionally, when extracting user buffers, the sglist is used as a scratch buffer which can overlap with existing entries.

MitigationApply the kernel patch to lib/scatterlist.c which properly enforces page boundary limits in extract_kvec_to_sg and prevents scratch buffer overlap. This requires patching and rebuilding the Linux kernel, or upgrading to a patched kernel version (v6.5+ with backport).

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Linux KernelOperating system
Affected:>= 6.3, < 6.6.140>= 6.7, < 6.12.88>= 6.13, < 6.18.30>= 6.19, < 7.0.7

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check the running kernel version
    Run `uname -r` to get the kernel version, or `cat /proc/version` for detailed version info
    Affected if The kernel version falls within any of these ranges: >= 6.3 and < 6.6.140; >= 6.7 and < 6.12.88; >= 6.13 and < 6.18.30; >= 6.19 and < 7.0.7
  2. Identify if the kernel has vulnerable scatterlist code
    Check for the presence of the affected functions in the kernel source or inspect /proc/kallsyms for symbols like extract_kvec_to_sg or related scatterlist functions
    Affected if The kernel was built from affected source versions and contains the vulnerable scatterlist functions (extract_kvec_to_sg and related code for kvec-to-sg and user buffer extraction)
  3. Determine if untrusted users can trigger the affected code paths
    Review system configuration and user access controls. Identify if there are untrusted or limited-privilege users who could invoke I/O operations that use the vulnerable scatterlist functions (kvec-based or user buffer scatterlist operations)
    Affected if Untrusted or limited-privilege users have access to functionalities that invoke the vulnerable scatterlist code paths

A system is affected if it runs a kernel version in the affected ranges AND has untrusted users or workloads that can trigger the kvec-to-scatterlist or user buffer scatterlist operations.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 6.6.140 / 6.12.88 / 6.18.30 or later
Fixed in 6.6.1406.12.886.18.30
Vendor patch git.kernel.org →
Interim mitigation

Apply the kernel patch to lib/scatterlist.c which properly enforces page boundary limits in extract_kvec_to_sg and prevents scratch buffer overlap. This requires patching and rebuilding the Linux kernel, or upgrading to a patched kernel version (v6.5+ with backport).

Recommended fix High confidence

Upgrade to Linux kernel 6.6.140+, 6.12.88+, 6.18.30+, or 7.0.7+ depending on which branch you are on

  1. Identify the current kernel version using `uname -r` or `cat /proc/version`
  2. Download or obtain the appropriate kernel package for your distribution that matches or exceeds the fixed version (6.6.140, 6.12.88, 6.18.30, or 7.0.7 depending on your branch)
  3. For RHEL/CentOS/Fedora: Update via `sudo dnf update kernel` or `sudo yum update kernel`
  4. For Debian/Ubuntu: Update via `sudo apt-get update && sudo apt-get install linux-image-<version>`
  5. For Arch Linux: Update via `sudo pacman -Syu linux`
  6. For SUSE: Update via `sudo zypper update kernel-default`
  7. Reboot the system to load the new kernel using `sudo reboot`
  8. Verify the new kernel is running with `uname -r` and confirm the version contains the fix (version >= one of the fixed releases)
Caveat Kernel upgrades may require rebooting services; test in staging first; some older kernel modules may need recompilation against the new kernel headers

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Linux Kernel Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing12.0 h
  • Review / QA6.0 h
30.0 hours of engineering $5,120
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,192.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-46289 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-46289 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data