diff --git a/mysql-test/suite/csv/delete.result b/mysql-test/suite/csv/delete.result
new file mode 100644
index 00000000000..73dc585fc26
--- /dev/null
+++ b/mysql-test/suite/csv/delete.result
@@ -0,0 +1,11 @@
+#
+# MDEV-40636 CSV crashes on DELETE
+#
+create table t1 (id int not null, pad char(10) not null) engine=csv;
+insert t1 select seq,'AAAAAAAAAA' from seq_1_to_2048;
+delete from t1 where id % 2 = 0;
+select count(*), sum(id) from t1;
+count(*)	sum(id)
+1024	1048576
+drop table t1;
+# End of 10.6 tests
diff --git a/mysql-test/suite/csv/delete.test b/mysql-test/suite/csv/delete.test
new file mode 100644
index 00000000000..2b4b1eea6c9
--- /dev/null
+++ b/mysql-test/suite/csv/delete.test
@@ -0,0 +1,13 @@
+--source include/have_csv.inc
+--source include/have_sequence.inc
+
+--echo #
+--echo # MDEV-40636 CSV crashes on DELETE
+--echo #
+create table t1 (id int not null, pad char(10) not null) engine=csv;
+insert t1 select seq,'AAAAAAAAAA' from seq_1_to_2048;
+delete from t1 where id % 2 = 0;
+select count(*), sum(id) from t1;
+drop table t1;
+
+--echo # End of 10.6 tests
diff --git a/storage/csv/ha_tina.cc b/storage/csv/ha_tina.cc
index 71c06776cfe..2251b75c973 100644
--- a/storage/csv/ha_tina.cc
+++ b/storage/csv/ha_tina.cc
@@ -1,4 +1,5 @@
 /* Copyright (c) 2004, 2011, Oracle and/or its affiliates.
+   Copyright (c) 2026, MariaDB plc
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -646,7 +647,8 @@ int ha_tina::chain_append()
       if (chain_alloced)
       {
         if ((chain= (tina_set *) my_realloc(csv_key_memory_tina_set,
-                                            (uchar*)chain, chain_size,
+                                            (uchar*)chain,
+                                            chain_size * sizeof(tina_set),
                                             MYF(MY_WME))) == NULL)
           return -1;
       }