CVE-2026-46006: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check nouveau_gem_pushbuf_reloc_apply() validates each relocation with if (r->reloc_bo_offset + 4 > nvbo->bo.base.size) but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size. Cast to u64 so the addition happens in 64-bit arithmetic. [ Add Fixes: tag. - Danilo ]

Affected products

• Linux Linux Kernel: from 2.6.34, before 5.15.209 (fixed in 5.15.209); from 5.16, before 6.1.175 (fixed in 6.1.175); from 6.2, before 6.6.140 (fixed in 6.6.140); from 6.7, before 6.12.86 (fixed in 6.12.86); from 6.13, before 6.18.27 (fixed in 6.18.27); from 6.19, before 7.0.4 (fixed in 7.0.4)

Published 2026-05-27. Last modified 2026-06-19.