rootpwn

high · CVSS v3 7.5

CVE-2026-97990

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as

Overview

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as a large positive length in the RX path. The bug can lead to memory corruption or denial of service when the kernel processes received packets. It was fixed by adding checks for non‑positive pull results before using the length.

Description

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.

Impact

The vulnerability can compromise confidentiality by allowing an attacker to read unintended memory, integrity by corrupting kernel data structures, and availability by causing crashes or hangs. System administrators managing Linux hosts that use the vdpa_sim_net driver are directly impacted.

Remediation

Apply the latest kernel update that includes the vdpa_sim_net patch. Verify that the kernel version is at least the one that contains the fix. If immediate patching is not possible, disable the vdpa_sim_net module or restrict its use until the update is applied. Monitor kernel logs for any anomalous memory access errors.

Risk context

Severity is high with a CVSS v3 score of 7.5. No EPSS data is available, but the flaw remains critical until patched.

Affected products

  • Linux kernel
  • vdpa_sim_net

Scores

Severity
high
CVSS v2
5.5
CVSS v3
7.5
CVSS v4
—
EPSS
—

Linux kernel vdpa high-severity CVE-2026-97990 defense patch

← All CVEs

Related CVEs

high

CVE-2026-98026

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug [1] that br_multicast_del_port_group unlists the port group not using proper rcu helper that preserves the next pointer and after that immediately frees the port group without waiting for rcu grace period. The only rcu walker of mglist is br_multicast_list_adjacent() and it turns out that function has always been buggy because mglist was never properly converted to RCU. Fix it by converting it to rcu and moving its initialization after eth_addr's. Initializing p->next can use RCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call later, besides we're initializing an unpublished structure anyway. [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com

View analysis

high

CVE-2026-98101

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

View analysis

high

CVE-2026-97991

CVE-2026-97991 is a Linux kernel vulnerability affecting the vDPA block device driver. It allows out-of-range buffer offsets to be used in read/write operations, leading to potential memory corruption. The flaw can be triggered by VIRTIO_BLK_T_IN, VIRTIO_BLK_T_OUT, or VIRTIO_BLK_T_WRITE_ZEROES requests.

View analysis

high

CVE-2026-97992

A use-after-free exists in the Linux kernel vhost-vdpa driver when the config eventfd context is swapped while a config callback can still reference it. The issue matters because local actors with access to VDUSE/vhost-vdpa devices can trigger kernel memory corruption. It is relevant to hosts or containers using virtual device emulation with vhost-vdpa and VDUSE.

View analysis