CVE-2026-46006

HighCVSS 7.8/10Last modified Jun 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

nouveau_gem_pushbuf_reloc_apply() validates each relocation with

if (r->reloc_bo_offset + 4 > nvbo->bo.base.size)

but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size.

Cast to u64 so the addition happens in 64-bit arithmetic.

[ Add Fixes: tag. - Danilo ]

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= a1606a9596e54da90ad6209071b357a4c1b0fa82, < 3429275684f4bad42876955301f3c5c814aae909; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < 573a1104bd36e49c067a9dc62e7c476d5ee7e92a; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < 45a45184b9c0b0b26ead06e370cda2073616a7cc; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < fa297e919d1680c38ab268ff952b1698dac987f6; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < d749a9a0ee4014681487e7ae549901aa8c176637; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < 332884f5eb79dd60a7162b079d09d39208567a31; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < e441d5c23ec644c8d27593db3b8928e8933512a9; >= a1606a9596e54da90ad6209071b357a4c1b0fa82, < 2fc87d37be1b730a149b035f9375fdb8cc5333a5
LinuxLinux2.6.34

References

Timeline

Published
May 27, 2026
Last modified
Jun 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-460075.5In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Avoid cacheline sharing for DMA buffer Depending on thCVE-2026-460084.7In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamondCVE-2026-460095.5In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown epf_ntbCVE-2026-46019.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash proCVE-2026-460108.1In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix error handling in rxgk_extract_token() Fix a missing bit ofCVE-2026-460117.8In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: fix use-after-free in release path due to uncancelled CVE-2026-460125.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix memory leaks in rxkad_verify_response() Fix rxkad_verify_reCVE-2026-460135.5In the Linux kernel, the following vulnerability has been resolved: mm/memfd_luo: fix physical address conversion in put_folios cleanup InCVE-2026-460145.5In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Add missing save/restore handling of LBR MSRs MSR_IA32_DEBUGCVE-2026-460157.8In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listeCVE-2026-460165.5In the Linux kernel, the following vulnerability has been resolved: remoteproc: xlnx: Only access buffer information if IPI is buffered InCVE-2026-460174.7In the Linux kernel, the following vulnerability has been resolved: mm: fix deferred split queue races during migration migrate_folio_move
CVE-2026-46006: High severity, CVSS 7.8 | Vulnix