CVE-2026-64297

In the Linux kernel, the following vulnerability has been resolved:

module: decompress: check return value of module_extend_max_pages()

module_extend_max_pages() calls kvrealloc() internally and returns

-ENOMEM on allocation failure. The return value is never checked.

If the initial allocation fails, info->pages remains NULL and

info->max_pages remains 0. Subsequent calls to module_get_next_page()

will attempt to dynamically grow the array by calling

module_extend_max_pages(info, 0) since info->used_pages is 0. This

results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated

as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel

oops.

Fix: add the missing error check after module_extend_max_pages() and

return immediately on failure. This matches the pattern used by every

other kvrealloc() caller in the module loading path.

[Sami: Corrected the analysis in the commit message.]