CVE-2026-90314

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() table->offset[i] is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer. The subsequent avail check was bypassed because the negative int was promoted to a large size_t in the expression "table_sz - offset - sizeof(*hdr)", yielding a large positive avail and letting the out-of-bounds hdr->type read proceed undetected. Store the offset as u32 and validate it with unsigned comparisons before any pointer arithmetic.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:29.203000

Last modified

2026-10-19 09:19:25.363000

View original CVE JSON

{
  "id": "CVE-2026-90314",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:29.203",
  "lastModified": "2026-10-19T09:19:25.363",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()\n\ntable->offset[i] is a u32 from firmware, but was stored into a signed\nint.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes\nbefore the table buffer.  The subsequent avail check was bypassed\nbecause the negative int was promoted to a large size_t in the\nexpression \"table_sz - offset - sizeof(*hdr)\", yielding a large positive\navail and letting the out-of-bounds hdr->type read proceed undetected.\n\nStore the offset as u32 and validate it with unsigned comparisons before\nany pointer arithmetic."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "include/linux/rsc_table.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "0d385be8f199b349f325cf90584b47b6a044ea79",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "c82241a9454b2d30d53b50884f94b7972ba44a5e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "bc4940793aaa16a9cf90063b11d6926f8014a1b7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "6fd220604f06c746760183df74b07384c3fdd660",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "6282d47b24b0c98d08d02807d676a7f67b4c052e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
              "lessThan": "bb840ea69347aff7bde5a208e7b5b180669a7656",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "include/linux/rsc_table.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.4",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.4",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.270",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.221",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0d385be8f199b349f325cf90584b47b6a044ea79",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6282d47b24b0c98d08d02807d676a7f67b4c052e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6fd220604f06c746760183df74b07384c3fdd660",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bb840ea69347aff7bde5a208e7b5b180669a7656",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc4940793aaa16a9cf90063b11d6926f8014a1b7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c82241a9454b2d30d53b50884f94b7972ba44a5e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}